theory CSpace_R

lemma cteInsert_simple_corres:
  assumes "cap_relation c c'" "src' = cte_map src" "dest' = cte_map dest"
  notes trans_state_update'[symmetric,simp]
  shows "corres dc
        (valid_objs and pspace_distinct and pspace_aligned and
         valid_mdb and valid_list and K (src\<noteq>dest) and
         cte_wp_at (\<lambda>c. c=cap.NullCap) dest and
         K (is_simple_cap c) and
         (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s))
        (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and
         K (is_simple_cap' c') and
         cte_wp_at' (\<lambda>c. cteCap c=NullCap) dest' and
         (\<lambda>s. safe_parent_for' (ctes_of s) src' c'))
        (cap_insert c src dest)
        (cteInsert c' src' dest')"
  (is "corres _ (?P and (\<lambda>s. cte_wp_at _ _ s)) (?P' and cte_wp_at' _ _ and _) _ _") using assms unfolding cap_insert_def cteInsert_def supply subst_all [simp del] apply simp apply (rule corres_guard_imp) apply (rule corres_split[OF get_cap_corres]) apply (rule corres_split[OF get_cap_corres]) apply (rule_tac F="cteCap rv' = NullCap" in corres_gen_asm2) apply simp apply (rule_tac P="?P and cte_at dest and
                            (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and
                            cte_wp_at ((=) src_cap) src" and
                        Q="?P' and
                           cte_wp_at' ((=) rv') (cte_map dest) and
                           cte_wp_at' ((=) srcCTE) (cte_map src) and
                           (\<lambda>s. safe_parent_for' (ctes_of s) src' c')"
                        in corres_assert_assume) prefer 2 apply (clarsimp simp: cte_wp_at_ctes_of valid_mdb'_def valid_mdb_ctes_def valid_nullcaps_def) apply (case_tac rv') apply (simp add: initMDBNode_def) apply (erule allE)+ apply (erule (1) impE) apply (simp add: nullPointer_def) apply (rule corres_guard_imp) apply (rule_tac R="\<lambda>r. ?P and cte_at dest and
                            (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and
                            cte_wp_at ((=) (masked_as_full src_cap c)) src" and
                        R'="\<lambda>r. ?P' and cte_wp_at' ((=) rv') (cte_map dest)
           and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src)
           and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')"
                        in corres_split[where r'=dc]) apply (rule setUntypedCapAsFull_corres; simp) apply (rule corres_stronger_no_failI) apply (rule no_fail_pre, wp hoare_weak_lift_imp) apply (clarsimp simp: cte_wp_at_ctes_of valid_mdb'_def valid_mdb_ctes_def) apply (erule_tac valid_dlistEn[where p = "cte_map src"]) apply (simp+)[3] apply (clarsimp simp: corres_underlying_def state_relation_def
                                  in_monad valid_mdb'_def valid_mdb_ctes_def) apply (drule (1) pspace_relationsD) apply (drule (18) set_cap_not_quite_corres) apply (rule refl) apply (elim conjE exE) apply (rule bind_execI, assumption) apply (subgoal_tac "mdb_insert_abs (cdt a) src dest") prefer 2 apply (clarsimp simp: cte_wp_at_caps_of_state valid_mdb_def2) apply (rule mdb_insert_abs.intro) apply clarsimp apply (erule (1) mdb_cte_at_Null_None) apply (erule (1) mdb_cte_at_Null_descendants) apply (subgoal_tac "no_mloop (cdt a)") prefer 2 apply (simp add: valid_mdb_def) apply (clarsimp simp: exec_gets update_cdt_def bind_assoc set_cdt_def
                                  exec_get exec_put set_original_def modify_def
                        simp del: fun_upd_apply

                   | (rule bind_execI[where f="cap_insert_ext x y z x' y'" for x y z x' y'], clarsimp simp: mdb_insert_abs.cap_insert_ext_det_def2 update_cdt_list_def set_cdt_list_def put_def simp del: fun_upd_apply) | rule refl)+ apply (clarsimp simp: put_def state_relation_def simp del: fun_upd_apply) apply (drule updateCap_stuff) apply clarsimp apply (drule (3) updateMDB_the_lot', simp only: no_0_modify_map, simp only:, elim conjE) apply (drule (3) updateMDB_the_lot', simp only: no_0_modify_map, simp only:, elim conjE) apply (drule (3) updateMDB_the_lot', simp only: no_0_modify_map, simp only:, elim conjE) apply (clarsimp simp: pspace_relations_def) apply (thin_tac "gsCNodes t = p" for t p)+ apply (thin_tac "ksMachineState t = p" for t p)+ apply (thin_tac "ksCurThread t = p" for t p)+ apply (thin_tac "ksWorkUnitsCompleted t = p" for t p)+ apply (thin_tac "ksIdleThread t = p" for t p)+ apply (thin_tac "ksReadyQueues t = p" for t p)+ apply (thin_tac "ksSchedulerAction t = p" for t p)+ apply (thin_tac "cur_thread t = p" for t p)+ apply (thin_tac "domain_index t = p" for t p)+ apply (thin_tac "domain_time t = p" for t p)+ apply (thin_tac "cur_domain t = p" for t p)+ apply (thin_tac "scheduler_action t = p" for t p)+ apply (thin_tac "ready_queues t = p" for t p)+ apply (thin_tac "idle_thread t = p" for t p)+ apply (thin_tac "machine_state t = p" for t p)+ apply (thin_tac "work_units_completed t = p" for t p)+ apply (thin_tac "ksArchState t = p" for t p)+ apply (thin_tac "gsUserPages t = p" for t p)+ apply (thin_tac "ksCurDomain t = p" for t p)+ apply (thin_tac "ksInterruptState t = p" for t p)+ apply (thin_tac "ksDomScheduleIdx t = p" for t p)+ apply (thin_tac "ksDomainTime t = p" for t p)+ apply (thin_tac "ksDomSchedule t = p" for t p)+ apply (thin_tac "ctes_of t = p" for t p)+ apply (thin_tac "ekheap_relation t p" for t p)+ apply (thin_tac "pspace_relation t p" for t p)+ apply (thin_tac "interrupt_state_relation s t p" for s t p)+ apply (thin_tac "sched_act_relation t p" for t p)+ apply (thin_tac "ready_queues_relation t p" for t p)+ apply (rule conjI) subgoal by (clarsimp simp: ghost_relation_typ_at set_cap_a_type_inv data_at_def) apply (clarsimp simp: cte_wp_at_ctes_of nullPointer_def prev_update_modify_mdb_relation) apply (subgoal_tac "cte_map dest \<noteq> 0") prefer 2 apply (clarsimp simp: valid_mdb'_def valid_mdb_ctes_def no_0_def) apply (subgoal_tac "cte_map src \<noteq> 0") prefer 2 apply (clarsimp simp: valid_mdb'_def valid_mdb_ctes_def no_0_def) apply (subgoal_tac "should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) = True") prefer 2 apply (subst should_be_parent_of_masked_as_full[symmetric]) apply (subst safe_parent_is_parent) apply ((simp add: cte_wp_at_caps_of_state)+)[4] apply (subst conj_assoc[symmetric]) apply (rule conjI) defer apply (clarsimp simp: modify_map_apply) apply (clarsimp simp: revokable_relation_def simp del: fun_upd_apply) apply (simp split: if_split) apply (rule conjI) apply clarsimp apply (subgoal_tac "mdbRevocable node = revokable' (cteCap srcCTE) c'") prefer 2 apply (case_tac rv') apply (clarsimp simp add: const_def modify_map_def split: if_split_asm) apply clarsimp apply (rule revokable_eq, assumption, assumption) apply (subst same_region_as_relation [symmetric]) prefer 3 apply (rule safe_parent_same_region) apply (simp add: cte_wp_at_caps_of_state) apply assumption apply assumption apply (clarsimp simp: cte_wp_at_def is_simple_cap_def) apply clarsimp apply (case_tac srcCTE) apply (case_tac rv') apply clarsimp apply (subgoal_tac "\<exists>cap' node'. ctes_of b (cte_map (aa,bb)) = Some (CTE cap' node')") prefer 2 subgoal by (clarsimp simp: modify_map_def split: if_split_asm) apply clarsimp apply (drule set_cap_caps_of_state_monad)+ apply (subgoal_tac "null_filter (caps_of_state a) (aa,bb) \<noteq> None") prefer 2 subgoal by (clarsimp simp: cte_wp_at_caps_of_state null_filter_def split: if_splits) apply clarsimp apply (subgoal_tac "cte_at (aa,bb) a") prefer 2 apply (drule null_filter_caps_of_stateD) apply (erule cte_wp_at_weakenE, rule TrueI) apply (subgoal_tac "mdbRevocable node = mdbRevocable node'") apply clarsimp apply (subgoal_tac "cte_map (aa,bb) \<noteq> cte_map dest") subgoal by (clarsimp simp: modify_map_def split: if_split_asm) apply (erule (5) cte_map_inj) apply (wp set_untyped_cap_full_valid_objs set_untyped_cap_as_full_valid_mdb
                      set_untyped_cap_as_full_valid_list set_untyped_cap_as_full_cte_wp_at
                      setUntypedCapAsFull_valid_cap setUntypedCapAsFull_cte_wp_at setUntypedCapAsFull_safe_parent_for'
                   | clarsimp | wps)+ apply (clarsimp simp:cte_wp_at_caps_of_state ) apply (case_tac rv',clarsimp simp:cte_wp_at_ctes_of maskedAsFull_def) apply (wp getCTE_wp' get_cap_wp)+ apply clarsimp subgoal by (fastforce elim: cte_wp_at_weakenE) subgoal by (clarsimp simp: cte_wp_at'_def) apply (case_tac "srcCTE") apply (rename_tac src_cap' src_node) apply (case_tac "rv'") apply (rename_tac dest_node) apply (clarsimp simp: in_set_cap_cte_at_swp) apply (subgoal_tac "cte_at src a \<and> safe_parent_for (cdt a) src c src_cap") prefer 2 subgoal by (fastforce simp: cte_wp_at_def) apply (erule conjE) apply (subgoal_tac "mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node
                                  (cte_map dest) NullCap dest_node") prefer 2 apply (rule mdb_insert.intro) apply (rule mdb_ptr.intro) apply (rule vmdb.intro, simp add: valid_mdb_ctes_def) apply (erule mdb_ptr_axioms.intro) apply (rule mdb_ptr.intro) apply (rule vmdb.intro, simp add: valid_mdb_ctes_def) apply (erule mdb_ptr_axioms.intro; assumption) apply (rule mdb_insert_axioms.intro; assumption?) apply (rule refl) apply (erule (5) cte_map_inj) apply (rule conjI) apply (simp (no_asm_simp) add: cdt_relation_def split: if_split) apply (intro impI allI) apply (frule mdb_insert_simple_axioms.intro) apply(clarsimp simp:cte_wp_at_ctes_of) apply (drule (1) mdb_insert_simple.intro) apply (drule_tac src_cap' = src_cap' in maskedAsFull_revokable_safe_parent[symmetric]) apply simp+ apply (subst mdb_insert_simple.descendants) apply simp apply (subst mdb_insert_abs.descendants_child, assumption) apply (frule set_cap_caps_of_state_monad) apply (subgoal_tac "cte_at (aa,bb) a") prefer 2 apply (clarsimp simp: cte_wp_at_caps_of_state split: if_split_asm) apply (simp add: descendants_of_eq' cdt_relation_def split: if_split del: split_paired_All) apply clarsimp apply (drule (5) cte_map_inj)+ apply simp 
  (* exact reproduction of proof in cteInsert_corres,
     as it does not used is_derived *)
   apply(simp add: cdt_list_relation_def del: split_paired_All split_paired_Ex) apply(subgoal_tac "no_mloop (cdt a) \<and> finite_depth (cdt a)") prefer 2 apply(simp add: finite_depth valid_mdb_def) apply(intro impI allI) apply(simp add: fun_upd_twist) apply(subst next_slot_eq[OF mdb_insert_abs.next_slot]) apply(simp_all del: fun_upd_apply) apply(simp split: option.splits del: fun_upd_apply add: fun_upd_twist) apply(intro allI impI) apply(subgoal_tac "src \<noteq> (aa, bb)") prefer 2 apply(rule notI) apply(simp add: valid_mdb_def no_mloop_weaken) apply(subst fun_upd_twist, simp, simp) apply(case_tac "ca=src") apply(simp) apply(clarsimp simp: modify_map_def) subgoal by(fastforce split: if_split_asm) apply(case_tac "ca = dest") apply(simp) apply(case_tac "next_slot src (cdt_list (a)) (cdt a)") apply(simp) apply(simp) apply(clarsimp simp: modify_map_def const_def) apply(simp split: if_split_asm) apply(drule_tac p="cte_map src" in valid_mdbD1') apply(simp) apply(simp add: valid_mdb'_def valid_mdb_ctes_def) apply(clarsimp) apply(drule cte_map_inj_eq) apply(simp_all)[6] apply(erule_tac x="fst src" in allE) apply(erule_tac x="snd src" in allE) apply(fastforce) apply(simp) apply(case_tac "next_slot ca (cdt_list (a)) (cdt a)") apply(simp) apply(simp) apply(subgoal_tac "cte_at ca a") prefer 2 apply(rule cte_at_next_slot) apply(simp_all)[5] apply(clarsimp simp: modify_map_def const_def) apply(simp split: if_split_asm) apply(drule cte_map_inj_eq) apply(simp_all)[6] apply(drule_tac p="cte_map src" in valid_mdbD1') apply(simp) apply(simp add: valid_mdb'_def valid_mdb_ctes_def) apply(clarsimp) apply(clarsimp) apply(case_tac z) apply(erule_tac x=aa in allE) apply(erule_tac x=bb in allE) apply(fastforce) apply(drule cte_map_inj_eq) apply(simp_all)[6] apply(drule cte_map_inj_eq) apply(simp_all)[6] apply(drule cte_map_inj_eq) apply(simp_all)[6] by(fastforce)

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. corres dc (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) dest' and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) (cap_insert c src dest) (cteInsert c' src' dest') proof (prove)
using this:
cap_relation c c'
src' = cte_map src
dest' = cte_map dest

goal (1 subgoal):
 1. corres dc (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) dest' and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) (cap_insert c src dest) (cteInsert c' src' dest') proof (prove)
using this:
cap_relation c c'
src' = cte_map src
dest' = cte_map dest

goal (1 subgoal):
 1. corres dc (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) dest' and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) (do src_cap <- get_cap src;
dest_original <- return $ revokable src_cap c;
old_cap <- get_cap dest;
assert (old_cap = cap.NullCap);
set_untyped_cap_as_full src_cap c src;
set_cap c dest;
is_original <- gets is_original_cap;
src_parent <- return $ should_be_parent_of src_cap (is_original src) c dest_original;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
update_cdt (\<lambda>cdt. cdt(dest := if src_parent then Some src else cdt src));
do_extended_op (cap_insert_ext src_parent src dest src_p dest_p);
set_original dest dest_original
od) (do srcCTE <- getCTE src';
srcMDB <- return (cteMDBNode srcCTE);
srcCap <- return (cteCap srcCTE);
newCapIsRevocable <- return (revokable' srcCap c');
newMDB <- return (mdbFirstBadged_update (\<lambda>_. newCapIsRevocable) (mdbRevocable_update (\<lambda>_. newCapIsRevocable) (mdbPrev_update (\<lambda>_. src') srcMDB)));
oldCTE <- getCTE dest';
haskell_assert (isNullCap $ cteCap oldCTE) [];
haskell_assert (mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer) [];
setUntypedCapAsFull srcCap c' src';
updateCap dest' c';
updateMDB dest' (const newMDB);
updateMDB src' (mdbNext_update (\<lambda>_. dest'));
updateMDB (mdbNext newMDB) (mdbPrev_update (\<lambda>_. dest'))
od) proof (prove)
using this:
cap_relation c c'
src' = cte_map src
dest' = cte_map dest

goal (1 subgoal):
 1. corres dc (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) dest' and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) (do src_cap <- get_cap src;
dest_original <- return $ revokable src_cap c;
old_cap <- get_cap dest;
assert (old_cap = cap.NullCap);
set_untyped_cap_as_full src_cap c src;
set_cap c dest;
is_original <- gets is_original_cap;
src_parent <- return $ should_be_parent_of src_cap (is_original src) c dest_original;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
update_cdt (\<lambda>cdt. cdt(dest := if src_parent then Some src else cdt src));
do_extended_op (cap_insert_ext src_parent src dest src_p dest_p);
set_original dest dest_original
od) (do srcCTE <- getCTE src';
srcMDB <- return (cteMDBNode srcCTE);
srcCap <- return (cteCap srcCTE);
newCapIsRevocable <- return (revokable' srcCap c');
newMDB <- return (mdbFirstBadged_update (\<lambda>_. newCapIsRevocable) (mdbRevocable_update (\<lambda>_. newCapIsRevocable) (mdbPrev_update (\<lambda>_. src') srcMDB)));
oldCTE <- getCTE dest';
haskell_assert (isNullCap $ cteCap oldCTE) [];
haskell_assert (mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer) [];
setUntypedCapAsFull srcCap c' src';
updateCap dest' c';
updateMDB dest' (const newMDB);
updateMDB src' (mdbNext_update (\<lambda>_. dest'));
updateMDB (mdbNext newMDB) (mdbPrev_update (\<lambda>_. dest'))
od) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> corres dc (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and (\<lambda>y. is_simple_cap' c') and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map dest) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map src) c')) (do src_cap <- get_cap src;
old_cap <- get_cap dest;
y <- assert (old_cap = cap.NullCap);
y <- set_untyped_cap_as_full src_cap c src;
y <- set_cap c dest;
is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
y <- update_cdt (\<lambda>cdt. cdt(dest := if should_be_parent_of src_cap (is_original src) c (revokable src_cap c) then Some src else cdt src));
y <- cap_insert_ext (should_be_parent_of src_cap (is_original src) c (revokable src_cap c)) src dest src_p dest_p;
set_original dest (revokable src_cap c)
od) (do srcCTE <- getCTE (cte_map src);
oldCTE <- getCTE (cte_map dest);
y <- assert (cteCap oldCTE = capability.NullCap);
y <- assert (mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer);
y <- setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src);
y <- updateCap (cte_map dest) c';
y <- updateMDB (cte_map dest) (const (mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))));
y <- updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest));
updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest))
od) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> corres dc ?Q3 ?Q'3 (do src_cap <- get_cap src;
old_cap <- get_cap dest;
y <- assert (old_cap = cap.NullCap);
y <- set_untyped_cap_as_full src_cap c src;
y <- set_cap c dest;
is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
y <- update_cdt (\<lambda>cdt. cdt(dest := if should_be_parent_of src_cap (is_original src) c (revokable src_cap c) then Some src else cdt src));
y <- cap_insert_ext (should_be_parent_of src_cap (is_original src) c (revokable src_cap c)) src dest src_p dest_p;
set_original dest (revokable src_cap c)
od) (do srcCTE <- getCTE (cte_map src);
oldCTE <- getCTE (cte_map dest);
y <- assert (cteCap oldCTE = capability.NullCap);
y <- assert (mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer);
y <- setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src);
y <- updateCap (cte_map dest) c';
y <- updateMDB (cte_map dest) (const (mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))));
y <- updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest));
updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest))
od)
 2. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> ?Q3 s
 3. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and (\<lambda>y. is_simple_cap' c') and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map dest) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map src) c')) s\<rbrakk> \<Longrightarrow> ?Q'3 s proof (prove)
goal (5 subgoals):
 1. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> corres dc (?R7 src_cap) (?R'7 srcCTE) (do old_cap <- get_cap dest;
y <- assert (old_cap = cap.NullCap);
y <- set_untyped_cap_as_full src_cap c src;
y <- set_cap c dest;
is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
y <- update_cdt (\<lambda>cdt. cdt(dest := if should_be_parent_of src_cap (is_original src) c (revokable src_cap c) then Some src else cdt src));
y <- cap_insert_ext (should_be_parent_of src_cap (is_original src) c (revokable src_cap c)) src dest src_p dest_p;
set_original dest (revokable src_cap c)
od) (do oldCTE <- getCTE (cte_map dest);
y <- assert (cteCap oldCTE = capability.NullCap);
y <- assert (mdbPrev (cteMDBNode oldCTE) = nullPointer \<and> mdbNext (cteMDBNode oldCTE) = nullPointer);
y <- setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src);
y <- updateCap (cte_map dest) c';
y <- updateMDB (cte_map dest) (const (mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))));
y <- updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest));
updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest))
od)
 2. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>?R7\<rbrace>
 3. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>?R'7\<rbrace>
 4. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
 5. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and (\<lambda>y. is_simple_cap' c') and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map dest) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map src) c')) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'7) s proof (prove)
goal (7 subgoals):
 1. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cap_relation rv (cteCap rv')\<rbrakk> \<Longrightarrow> corres dc (?R12 src_cap srcCTE rv) (?R'12 src_cap srcCTE rv') (do y <- assert (rv = cap.NullCap);
y <- set_untyped_cap_as_full src_cap c src;
y <- set_cap c dest;
is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
y <- update_cdt (\<lambda>cdt. cdt(dest := if should_be_parent_of src_cap (is_original src) c (revokable src_cap c) then Some src else cdt src));
y <- cap_insert_ext (should_be_parent_of src_cap (is_original src) c (revokable src_cap c)) src dest src_p dest_p;
set_original dest (revokable src_cap c)
od) (do y <- assert (cteCap rv' = capability.NullCap);
y <- assert (mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer);
y <- setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src);
y <- updateCap (cte_map dest) c';
y <- updateMDB (cte_map dest) (const (mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))));
y <- updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest));
updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest))
od)
 2. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>?R12 src_cap srcCTE\<rbrace>
 3. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>?R'12 src_cap srcCTE\<rbrace>
 4. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 5. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 6. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
 7. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and (\<lambda>y. is_simple_cap' c') and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map dest) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map src) c')) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'7) s proof (prove)
goal (7 subgoals):
 1. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cap_relation rv (cteCap rv'); cteCap rv' = capability.NullCap\<rbrakk> \<Longrightarrow> corres dc (?R12 src_cap srcCTE rv) (?P'21 src_cap srcCTE rv') (do y <- assert (rv = cap.NullCap);
y <- set_untyped_cap_as_full src_cap c src;
y <- set_cap c dest;
is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
y <- update_cdt (\<lambda>cdt. cdt(dest := if should_be_parent_of src_cap (is_original src) c (revokable src_cap c) then Some src else cdt src));
y <- cap_insert_ext (should_be_parent_of src_cap (is_original src) c (revokable src_cap c)) src dest src_p dest_p;
set_original dest (revokable src_cap c)
od) (do y <- assert (cteCap rv' = capability.NullCap);
y <- assert (mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer);
y <- setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src);
y <- updateCap (cte_map dest) c';
y <- updateMDB (cte_map dest) (const (mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))));
y <- updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest));
updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest))
od)
 2. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>?R12 src_cap srcCTE\<rbrace>
 3. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. ?P'21 src_cap srcCTE rv' and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 4. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 5. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 6. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
 7. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and (\<lambda>y. is_simple_cap' c') and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map dest) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map src) c')) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'7) s proof (prove)
goal (7 subgoals):
 1. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap\<rbrakk> \<Longrightarrow> corres dc (?R12 src_cap srcCTE cap.NullCap) (?P'21 src_cap srcCTE rv') (do y <- set_untyped_cap_as_full src_cap c src;
y <- set_cap c dest;
is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
y <- update_cdt (\<lambda>cdt. cdt(dest := if should_be_parent_of src_cap (is_original src) c (revokable src_cap c) then Some src else cdt src));
y <- cap_insert_ext (should_be_parent_of src_cap (is_original src) c (revokable src_cap c)) src dest src_p dest_p;
set_original dest (revokable src_cap c)
od) (do y <- assert (mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer);
y <- setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src);
y <- updateCap (cte_map dest) c';
y <- updateMDB (cte_map dest) (const (mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))));
y <- updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest));
updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest))
od)
 2. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>?R12 src_cap srcCTE\<rbrace>
 3. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. ?P'21 src_cap srcCTE rv' and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 4. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 5. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 6. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
 7. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and (\<lambda>y. is_simple_cap' c') and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map dest) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map src) c')) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'7) s proof (prove)
goal (8 subgoals):
 1. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> corres dc (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) (do y <- set_untyped_cap_as_full src_cap c src;
y <- set_cap c dest;
is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
y <- update_cdt (\<lambda>cdt. cdt(dest := if should_be_parent_of src_cap (is_original src) c (revokable src_cap c) then Some src else cdt src));
y <- cap_insert_ext (should_be_parent_of src_cap (is_original src) c (revokable src_cap c)) src dest src_p dest_p;
set_original dest (revokable src_cap c)
od) (do y <- setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src);
y <- updateCap (cte_map dest) c';
y <- updateMDB (cte_map dest) (const (mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))));
y <- updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest));
updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest))
od)
 2. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer
 3. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 4. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 5. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 6. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 7. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
 8. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and (\<lambda>y. is_simple_cap' c') and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map dest) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map src) c')) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'7) s proof (prove)
goal (8 subgoals):
 1. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> corres dc (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) (do y <- set_untyped_cap_as_full src_cap c src;
y <- set_cap c dest;
is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
y <- update_cdt (\<lambda>cdt. cdt(dest := if should_be_parent_of src_cap (is_original src) c (revokable src_cap c) then Some src else cdt src));
y <- cap_insert_ext (should_be_parent_of src_cap (is_original src) c (revokable src_cap c)) src dest src_p dest_p;
set_original dest (revokable src_cap c)
od) (do y <- setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src);
y <- updateCap (cte_map dest) c';
y <- updateMDB (cte_map dest) (const (mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))));
y <- updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest));
updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest))
od)
 3. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 4. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 5. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 6. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 7. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
 8. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and (\<lambda>y. is_simple_cap' c') and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map dest) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map src) c')) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'7) s proof (prove)
goal (8 subgoals):
 1. \<And>src_cap srcCTE rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; pspace_distinct' s; pspace_aligned' s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); \<forall>p n. ctes_of s p = Some (CTE capability.NullCap n) \<longrightarrow> n = nullMDBNode; ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); valid_cap' c' s; is_simple_cap' c'; ctes_of s (cte_map dest) = Some rv'; ctes_of s (cte_map src) = Some srcCTE; safe_parent_for' (ctes_of s) (cte_map src) c'\<rbrakk> \<Longrightarrow> mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> corres dc (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) (do y <- set_untyped_cap_as_full src_cap c src;
y <- set_cap c dest;
is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
y <- update_cdt (\<lambda>cdt. cdt(dest := if should_be_parent_of src_cap (is_original src) c (revokable src_cap c) then Some src else cdt src));
y <- cap_insert_ext (should_be_parent_of src_cap (is_original src) c (revokable src_cap c)) src dest src_p dest_p;
set_original dest (revokable src_cap c)
od) (do y <- setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src);
y <- updateCap (cte_map dest) c';
y <- updateMDB (cte_map dest) (const (mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))));
y <- updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest));
updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest))
od)
 3. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 4. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 5. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 6. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 7. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
 8. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and (\<lambda>y. is_simple_cap' c') and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map dest) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map src) c')) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'7) s proof (prove)
goal (8 subgoals):
 1. \<And>src_cap srcCTE rv' s x1 x2. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; pspace_distinct' s; pspace_aligned' s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); \<forall>p n. ctes_of s p = Some (CTE capability.NullCap n) \<longrightarrow> n = nullMDBNode; ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); valid_cap' c' s; is_simple_cap' c'; ctes_of s (cte_map dest) = Some rv'; ctes_of s (cte_map src) = Some srcCTE; safe_parent_for' (ctes_of s) (cte_map src) c'; rv' = CTE x1 x2\<rbrakk> \<Longrightarrow> mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> corres dc (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) (do y <- set_untyped_cap_as_full src_cap c src;
y <- set_cap c dest;
is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
y <- update_cdt (\<lambda>cdt. cdt(dest := if should_be_parent_of src_cap (is_original src) c (revokable src_cap c) then Some src else cdt src));
y <- cap_insert_ext (should_be_parent_of src_cap (is_original src) c (revokable src_cap c)) src dest src_p dest_p;
set_original dest (revokable src_cap c)
od) (do y <- setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src);
y <- updateCap (cte_map dest) c';
y <- updateMDB (cte_map dest) (const (mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))));
y <- updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest));
updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest))
od)
 3. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 4. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 5. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 6. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 7. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
 8. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and (\<lambda>y. is_simple_cap' c') and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map dest) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map src) c')) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'7) s proof (prove)
goal (8 subgoals):
 1. \<And>src_cap srcCTE rv' s x1 x2. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); x1 = capability.NullCap; pspace_distinct' s; pspace_aligned' s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); \<forall>p n. ctes_of s p = Some (CTE capability.NullCap n) \<longrightarrow> n = nullMDBNode; ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); valid_cap' c' s; is_simple_cap' c'; ctes_of s (cte_map dest) = Some (CTE capability.NullCap x2); ctes_of s (cte_map src) = Some srcCTE; safe_parent_for' (ctes_of s) (cte_map src) c'; rv' = CTE capability.NullCap x2\<rbrakk> \<Longrightarrow> mdbPrev x2 = nullPointer \<and> mdbNext x2 = nullPointer
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> corres dc (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) (do y <- set_untyped_cap_as_full src_cap c src;
y <- set_cap c dest;
is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
y <- update_cdt (\<lambda>cdt. cdt(dest := if should_be_parent_of src_cap (is_original src) c (revokable src_cap c) then Some src else cdt src));
y <- cap_insert_ext (should_be_parent_of src_cap (is_original src) c (revokable src_cap c)) src dest src_p dest_p;
set_original dest (revokable src_cap c)
od) (do y <- setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src);
y <- updateCap (cte_map dest) c';
y <- updateMDB (cte_map dest) (const (mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))));
y <- updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest));
updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest))
od)
 3. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 4. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 5. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 6. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 7. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
 8. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and (\<lambda>y. is_simple_cap' c') and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map dest) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map src) c')) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'7) s proof (prove)
goal (8 subgoals):
 1. \<And>src_cap srcCTE rv' s x1 x2. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); x1 = capability.NullCap; pspace_distinct' s; pspace_aligned' s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); valid_cap' c' s; is_simple_cap' c'; ctes_of s (cte_map dest) = Some (CTE capability.NullCap x2); ctes_of s (cte_map src) = Some srcCTE; safe_parent_for' (ctes_of s) (cte_map src) c'; rv' = CTE capability.NullCap x2; ctes_of s (?p47 src_cap srcCTE rv' s x1 x2) = Some (CTE capability.NullCap (?n49 src_cap srcCTE rv' s x1 x2)) \<longrightarrow> ?n49 src_cap srcCTE rv' s x1 x2 = nullMDBNode\<rbrakk> \<Longrightarrow> mdbPrev x2 = nullPointer \<and> mdbNext x2 = nullPointer
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> corres dc (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) (do y <- set_untyped_cap_as_full src_cap c src;
y <- set_cap c dest;
is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
y <- update_cdt (\<lambda>cdt. cdt(dest := if should_be_parent_of src_cap (is_original src) c (revokable src_cap c) then Some src else cdt src));
y <- cap_insert_ext (should_be_parent_of src_cap (is_original src) c (revokable src_cap c)) src dest src_p dest_p;
set_original dest (revokable src_cap c)
od) (do y <- setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src);
y <- updateCap (cte_map dest) c';
y <- updateMDB (cte_map dest) (const (mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))));
y <- updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest));
updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest))
od)
 3. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 4. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 5. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 6. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 7. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
 8. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and (\<lambda>y. is_simple_cap' c') and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map dest) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map src) c')) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'7) s proof (prove)
goal (8 subgoals):
 1. \<And>src_cap srcCTE rv' s x1 x2. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); x1 = capability.NullCap; pspace_distinct' s; pspace_aligned' s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); valid_cap' c' s; is_simple_cap' c'; ctes_of s (cte_map dest) = Some (CTE capability.NullCap x2); ctes_of s (cte_map src) = Some srcCTE; safe_parent_for' (ctes_of s) (cte_map src) c'; rv' = CTE capability.NullCap x2; x2 = nullMDBNode\<rbrakk> \<Longrightarrow> mdbPrev x2 = nullPointer \<and> mdbNext x2 = nullPointer
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> corres dc (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) (do y <- set_untyped_cap_as_full src_cap c src;
y <- set_cap c dest;
is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
y <- update_cdt (\<lambda>cdt. cdt(dest := if should_be_parent_of src_cap (is_original src) c (revokable src_cap c) then Some src else cdt src));
y <- cap_insert_ext (should_be_parent_of src_cap (is_original src) c (revokable src_cap c)) src dest src_p dest_p;
set_original dest (revokable src_cap c)
od) (do y <- setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src);
y <- updateCap (cte_map dest) c';
y <- updateMDB (cte_map dest) (const (mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))));
y <- updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest));
updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest))
od)
 3. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 4. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 5. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 6. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 7. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
 8. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and (\<lambda>y. is_simple_cap' c') and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map dest) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map src) c')) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'7) s proof (prove)
goal (7 subgoals):
 1. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> corres dc (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) (do y <- set_untyped_cap_as_full src_cap c src;
y <- set_cap c dest;
is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
y <- update_cdt (\<lambda>cdt. cdt(dest := if should_be_parent_of src_cap (is_original src) c (revokable src_cap c) then Some src else cdt src));
y <- cap_insert_ext (should_be_parent_of src_cap (is_original src) c (revokable src_cap c)) src dest src_p dest_p;
set_original dest (revokable src_cap c)
od) (do y <- setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src);
y <- updateCap (cte_map dest) c';
y <- updateMDB (cte_map dest) (const (mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))));
y <- updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest));
updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest))
od)
 2. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 3. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 4. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 5. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 6. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
 7. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and (\<lambda>y. is_simple_cap' c') and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map dest) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map src) c')) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'7) s proof (prove)
goal (9 subgoals):
 1. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> corres dc (?Q54 src_cap srcCTE rv rv') (?Q'54 src_cap srcCTE rv rv') (do y <- set_untyped_cap_as_full src_cap c src;
y <- set_cap c dest;
is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
y <- update_cdt (\<lambda>cdt. cdt(dest := if should_be_parent_of src_cap (is_original src) c (revokable src_cap c) then Some src else cdt src));
y <- cap_insert_ext (should_be_parent_of src_cap (is_original src) c (revokable src_cap c)) src dest src_p dest_p;
set_original dest (revokable src_cap c)
od) (do y <- setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src);
y <- updateCap (cte_map dest) c';
y <- updateMDB (cte_map dest) (const (mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))));
y <- updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest));
updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest))
od)
 2. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> ?Q54 src_cap srcCTE rv rv' s
 3. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> ?Q'54 src_cap srcCTE rv rv' s
 4. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 5. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 6. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 7. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 8. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
 9. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and (\<lambda>y. is_simple_cap' c') and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map dest) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map src) c')) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'7) s proof (prove)
goal (12 subgoals):
 1. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> corres dc (?P58 src_cap srcCTE rv rv') (?P'58 src_cap srcCTE rv rv') (set_untyped_cap_as_full src_cap c src) (setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src))
 2. \<And>src_cap srcCTE rv rv' rva rv'a. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src) (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) (do y <- set_cap c dest;
is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
y <- update_cdt (\<lambda>cdt. cdt(dest := if should_be_parent_of src_cap (is_original src) c (revokable src_cap c) then Some src else cdt src));
y <- cap_insert_ext (should_be_parent_of src_cap (is_original src) c (revokable src_cap c)) src dest src_p dest_p;
set_original dest (revokable src_cap c)
od) (do y <- updateCap (cte_map dest) c';
y <- updateMDB (cte_map dest) (const (mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))));
y <- updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest));
updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest))
od)
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 4. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (?P58 src_cap srcCTE rv rv' and ?Q58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (?P'58 src_cap srcCTE rv rv' and ?Q'58 src_cap srcCTE rv rv') s
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 8. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 10. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv rv' rva rv'a. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; dc rva rv'a\<rbrakk> \<Longrightarrow> corres dc (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src) (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) (do y <- set_cap c dest;
is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
y <- update_cdt (\<lambda>cdt. cdt(dest := if should_be_parent_of src_cap (is_original src) c (revokable src_cap c) then Some src else cdt src));
y <- cap_insert_ext (should_be_parent_of src_cap (is_original src) c (revokable src_cap c)) src dest src_p dest_p;
set_original dest (revokable src_cap c)
od) (do y <- updateCap (cte_map dest) c';
y <- updateMDB (cte_map dest) (const (mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))));
y <- updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest));
updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest))
od)
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>src_cap srcCTE rv rv' rva rv'a. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; dc rva rv'a; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. \<exists>s. (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src) s \<and> (s, s') \<in> state_relation \<and> (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s') (do y <- updateCap (cte_map dest) c';
y <- updateMDB (cte_map dest) (const (mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))));
y <- updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest));
updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest))
od)
 2. \<And>src_cap srcCTE rv rv' rva rv'a. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; dc rva rv'a\<rbrakk> \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src) s \<and> (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do y <- updateCap (cte_map dest) c';
y <- updateMDB (cte_map dest) (const (mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))));
y <- updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest));
updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest))
od) s'). \<exists>(r, t)\<in>fst ((do y <- set_cap c dest;
is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
y <- update_cdt (\<lambda>cdt. cdt(dest := if should_be_parent_of src_cap (is_original src) c (revokable src_cap c) then Some src else cdt src));
y <- cap_insert_ext (should_be_parent_of src_cap (is_original src) c (revokable src_cap c)) src dest src_p dest_p;
set_original dest (revokable src_cap c)
od) s). (t, t') \<in> state_relation \<and> dc r r')
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 4. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 8. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 10. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>src_cap srcCTE rv rv' rva rv'a s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; dc rva rv'a; True; \<exists>sa. (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src) sa \<and> (sa, s) \<in> state_relation \<and> (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map dest) and (\<lambda>s. (cte_map dest \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map dest) s) \<and> (cte_map src \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map src) s) \<and> (mdbNext (cteMDBNode srcCTE) \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode srcCTE)) s))) s
 2. \<And>src_cap srcCTE rv rv' rva rv'a. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; dc rva rv'a\<rbrakk> \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src) s \<and> (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do y <- updateCap (cte_map dest) c';
y <- updateMDB (cte_map dest) (const (mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))));
y <- updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest));
updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest))
od) s'). \<exists>(r, t)\<in>fst ((do y <- set_cap c dest;
is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
y <- update_cdt (\<lambda>cdt. cdt(dest := if should_be_parent_of src_cap (is_original src) c (revokable src_cap c) then Some src else cdt src));
y <- cap_insert_ext (should_be_parent_of src_cap (is_original src) c (revokable src_cap c)) src dest src_p dest_p;
set_original dest (revokable src_cap c)
od) s). (t, t') \<in> state_relation \<and> dc r r')
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 4. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 8. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 10. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>src_cap srcCTE rv' s sa. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; valid_objs sa; pspace_distinct sa; pspace_aligned sa; valid_mdb sa; valid_list sa; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest sa; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest sa; cte_wp_at (safe_parent_for (cdt sa) src c) src sa; cte_wp_at ((=) (masked_as_full src_cap c)) src sa; (sa, s) \<in> state_relation; pspace_distinct' s; pspace_aligned' s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); valid_cap' c' s; is_simple_cap' c'; ctes_of s (cte_map dest) = Some rv'; ctes_of s (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of s) (cte_map src) c'; mdbNext (cteMDBNode srcCTE) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (mdbNext (cteMDBNode srcCTE)) = Some cte
 2. \<And>src_cap srcCTE rv rv' rva rv'a. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; dc rva rv'a\<rbrakk> \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src) s \<and> (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do y <- updateCap (cte_map dest) c';
y <- updateMDB (cte_map dest) (const (mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))));
y <- updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest));
updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest))
od) s'). \<exists>(r, t)\<in>fst ((do y <- set_cap c dest;
is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
y <- update_cdt (\<lambda>cdt. cdt(dest := if should_be_parent_of src_cap (is_original src) c (revokable src_cap c) then Some src else cdt src));
y <- cap_insert_ext (should_be_parent_of src_cap (is_original src) c (revokable src_cap c)) src dest src_p dest_p;
set_original dest (revokable src_cap c)
od) s). (t, t') \<in> state_relation \<and> dc r r')
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 4. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 8. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 10. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
A total of 12 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>src_cap srcCTE rv' s sa. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; valid_objs sa; pspace_distinct sa; pspace_aligned sa; valid_mdb sa; valid_list sa; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest sa; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest sa; cte_wp_at (safe_parent_for (cdt sa) src c) src sa; cte_wp_at ((=) (masked_as_full src_cap c)) src sa; (sa, s) \<in> state_relation; pspace_distinct' s; pspace_aligned' s; no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); valid_cap' c' s; is_simple_cap' c'; ctes_of s (cte_map dest) = Some rv'; ctes_of s (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of s) (cte_map src) c'; mdbNext (cteMDBNode srcCTE) \<noteq> 0\<rbrakk> \<Longrightarrow> ctes_of s (cte_map src) = Some (?cte153 src_cap srcCTE rv' s sa)
 2. \<And>src_cap srcCTE rv' s sa. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; valid_objs sa; pspace_distinct sa; pspace_aligned sa; valid_mdb sa; valid_list sa; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest sa; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest sa; cte_wp_at (safe_parent_for (cdt sa) src c) src sa; cte_wp_at ((=) (masked_as_full src_cap c)) src sa; (sa, s) \<in> state_relation; pspace_distinct' s; pspace_aligned' s; no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); valid_cap' c' s; is_simple_cap' c'; ctes_of s (cte_map dest) = Some rv'; ctes_of s (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of s) (cte_map src) c'; mdbNext (cteMDBNode srcCTE) \<noteq> 0\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode (?cte153 src_cap srcCTE rv' s sa)) \<noteq> 0
 3. \<And>src_cap srcCTE rv' s sa cte'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; valid_objs sa; pspace_distinct sa; pspace_aligned sa; valid_mdb sa; valid_list sa; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest sa; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest sa; cte_wp_at (safe_parent_for (cdt sa) src c) src sa; cte_wp_at ((=) (masked_as_full src_cap c)) src sa; (sa, s) \<in> state_relation; pspace_distinct' s; pspace_aligned' s; no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); valid_cap' c' s; is_simple_cap' c'; ctes_of s (cte_map dest) = Some rv'; ctes_of s (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of s) (cte_map src) c'; mdbNext (cteMDBNode srcCTE) \<noteq> 0; ctes_of s (mdbNext (cteMDBNode (?cte153 src_cap srcCTE rv' s sa))) = Some cte'; mdbPrev (cteMDBNode cte') = cte_map src\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (mdbNext (cteMDBNode srcCTE)) = Some cte
 4. \<And>src_cap srcCTE rv rv' rva rv'a. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; dc rva rv'a\<rbrakk> \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src) s \<and> (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do y <- updateCap (cte_map dest) c';
y <- updateMDB (cte_map dest) (const (mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))));
y <- updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest));
updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest))
od) s'). \<exists>(r, t)\<in>fst ((do y <- set_cap c dest;
is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
y <- update_cdt (\<lambda>cdt. cdt(dest := if should_be_parent_of src_cap (is_original src) c (revokable src_cap c) then Some src else cdt src));
y <- cap_insert_ext (should_be_parent_of src_cap (is_original src) c (revokable src_cap c)) src dest src_p dest_p;
set_original dest (revokable src_cap c)
od) s). (t, t') \<in> state_relation \<and> dc r r')
 5. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 6. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 7. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 8. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 9. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 10. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
A total of 14 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv rv' rva rv'a. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; dc rva rv'a\<rbrakk> \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src) s \<and> (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do y <- updateCap (cte_map dest) c';
y <- updateMDB (cte_map dest) (const (mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))));
y <- updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest));
updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest))
od) s'). \<exists>(r, t)\<in>fst ((do y <- set_cap c dest;
is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
y <- update_cdt (\<lambda>cdt. cdt(dest := if should_be_parent_of src_cap (is_original src) c (revokable src_cap c) then Some src else cdt src));
y <- cap_insert_ext (should_be_parent_of src_cap (is_original src) c (revokable src_cap c)) src dest src_p dest_p;
set_original dest (revokable src_cap c)
od) s). (t, t') \<in> state_relation \<and> dc r r')
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), s'') \<in> fst (updateCap (cte_map dest) c' b); ((), s''a) \<in> fst (updateMDB (cte_map dest) (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) s''); ((), s''b) \<in> fst (updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest)) s''a); ((), ba) \<in> fst (updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest)) s''b)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap c dest;
is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
y <- update_cdt (\<lambda>cdt. cdt(dest := if should_be_parent_of src_cap (is_original src) c (revokable src_cap c) then Some src else cdt src));
y <- cap_insert_ext (should_be_parent_of src_cap (is_original src) c (revokable src_cap c)) src dest src_p dest_p;
set_original dest (revokable src_cap c)
od) a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), s'') \<in> fst (updateCap (cte_map dest) c' b); ((), s''a) \<in> fst (updateMDB (cte_map dest) (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) s''); ((), s''b) \<in> fst (updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest)) s''a); ((), ba) \<in> fst (updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest)) s''b); pspace_relations (ekheap a) (kheap a) (ksPSpace b)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap c dest;
is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
y <- update_cdt (\<lambda>cdt. cdt(dest := if should_be_parent_of src_cap (is_original src) c (revokable src_cap c) then Some src else cdt src));
y <- cap_insert_ext (should_be_parent_of src_cap (is_original src) c (revokable src_cap c)) src dest src_p dest_p;
set_original dest (revokable src_cap c)
od) a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), s'') \<in> fst (updateCap (cte_map dest) c' b); ((), s''a) \<in> fst (updateMDB (cte_map dest) (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) s''); ((), s''b) \<in> fst (updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest)) s''a); ((), ba) \<in> fst (updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest)) s''b)\<rbrakk> \<Longrightarrow> cte_map dest = cte_map dest
 2. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), s'') \<in> fst (updateCap (cte_map dest) c' b); ((), s''a) \<in> fst (updateMDB (cte_map dest) (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) s''); ((), s''b) \<in> fst (updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest)) s''a); ((), ba) \<in> fst (updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest)) s''b); \<exists>t. ((), t) \<in> fst (set_cap c dest a) \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace s'') \<and> cdt t = cdt a \<and> cdt_list t = cdt_list a \<and> ekheap t = ekheap a \<and> scheduler_action t = scheduler_action a \<and> ready_queues t = ready_queues a \<and> is_original_cap t = is_original_cap a \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s'') \<and> (arch_state t, ksArchState s'') \<in> arch_state_relation \<and> cur_thread t = ksCurThread s'' \<and> idle_thread t = ksIdleThread s'' \<and> machine_state t = ksMachineState s'' \<and> work_units_completed t = ksWorkUnitsCompleted s'' \<and> domain_index t = ksDomScheduleIdx s'' \<and> domain_list t = ksDomSchedule s'' \<and> cur_domain t = ksCurDomain s'' \<and> domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap c dest;
is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
y <- update_cdt (\<lambda>cdt. cdt(dest := if should_be_parent_of src_cap (is_original src) c (revokable src_cap c) then Some src else cdt src));
y <- cap_insert_ext (should_be_parent_of src_cap (is_original src) c (revokable src_cap c)) src dest src_p dest_p;
set_original dest (revokable src_cap c)
od) a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 4. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 8. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 10. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), s'') \<in> fst (updateCap (cte_map dest) c' b); ((), s''a) \<in> fst (updateMDB (cte_map dest) (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) s''); ((), s''b) \<in> fst (updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest)) s''a); ((), ba) \<in> fst (updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest)) s''b); \<exists>t. ((), t) \<in> fst (set_cap c dest a) \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace s'') \<and> cdt t = cdt a \<and> cdt_list t = cdt_list a \<and> ekheap t = ekheap a \<and> scheduler_action t = scheduler_action a \<and> ready_queues t = ready_queues a \<and> is_original_cap t = is_original_cap a \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s'') \<and> (arch_state t, ksArchState s'') \<in> arch_state_relation \<and> cur_thread t = ksCurThread s'' \<and> idle_thread t = ksIdleThread s'' \<and> machine_state t = ksMachineState s'' \<and> work_units_completed t = ksWorkUnitsCompleted s'' \<and> domain_index t = ksDomScheduleIdx s'' \<and> domain_list t = ksDomSchedule s'' \<and> cur_domain t = ksCurDomain s'' \<and> domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap c dest;
is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
y <- update_cdt (\<lambda>cdt. cdt(dest := if should_be_parent_of src_cap (is_original src) c (revokable src_cap c) then Some src else cdt src));
y <- cap_insert_ext (should_be_parent_of src_cap (is_original src) c (revokable src_cap c)) src dest src_p dest_p;
set_original dest (revokable src_cap c)
od) a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), s'') \<in> fst (updateCap (cte_map dest) c' b); ((), s''a) \<in> fst (updateMDB (cte_map dest) (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) s''); ((), s''b) \<in> fst (updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest)) s''a); ((), ba) \<in> fst (updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest)) s''b); ((), t) \<in> fst (set_cap c dest a); pspace_relations (ekheap t) (kheap t) (ksPSpace s''); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do y <- set_cap c dest;
is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
y <- update_cdt (\<lambda>cdt. cdt(dest := if should_be_parent_of src_cap (is_original src) c (revokable src_cap c) then Some src else cdt src));
y <- cap_insert_ext (should_be_parent_of src_cap (is_original src) c (revokable src_cap c)) src dest src_p dest_p;
set_original dest (revokable src_cap c)
od) a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), s'') \<in> fst (updateCap (cte_map dest) c' b); ((), s''a) \<in> fst (updateMDB (cte_map dest) (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) s''); ((), s''b) \<in> fst (updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest)) s''a); ((), ba) \<in> fst (updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest)) s''b); ((), t) \<in> fst (set_cap c dest a); pspace_relations (ekheap t) (kheap t) (ksPSpace s''); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
y <- update_cdt (\<lambda>cdt. cdt(dest := if should_be_parent_of src_cap (is_original src) c (revokable src_cap c) then Some src else cdt src));
y <- cap_insert_ext (should_be_parent_of src_cap (is_original src) c (revokable src_cap c)) src dest src_p dest_p;
set_original dest (revokable src_cap c)
od) t). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), s'') \<in> fst (updateCap (cte_map dest) c' b); ((), s''a) \<in> fst (updateMDB (cte_map dest) (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) s''); ((), s''b) \<in> fst (updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest)) s''a); ((), ba) \<in> fst (updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest)) s''b); ((), t) \<in> fst (set_cap c dest a); pspace_relations (ekheap t) (kheap t) (ksPSpace s''); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; mdb_insert_abs (cdt a) src dest\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
y <- update_cdt (\<lambda>cdt. cdt(dest := if should_be_parent_of src_cap (is_original src) c (revokable src_cap c) then Some src else cdt src));
y <- cap_insert_ext (should_be_parent_of src_cap (is_original src) c (revokable src_cap c)) src dest src_p dest_p;
set_original dest (revokable src_cap c)
od) t). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 2. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), s'') \<in> fst (updateCap (cte_map dest) c' b); ((), s''a) \<in> fst (updateMDB (cte_map dest) (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) s''); ((), s''b) \<in> fst (updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest)) s''a); ((), ba) \<in> fst (updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest)) s''b); ((), t) \<in> fst (set_cap c dest a); pspace_relations (ekheap t) (kheap t) (ksPSpace s''); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> mdb_insert_abs (cdt a) src dest
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 4. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 8. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 10. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), s'') \<in> fst (updateCap (cte_map dest) c' b); ((), s''a) \<in> fst (updateMDB (cte_map dest) (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) s''); ((), s''b) \<in> fst (updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest)) s''a); ((), ba) \<in> fst (updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest)) s''b); ((), t) \<in> fst (set_cap c dest a); pspace_relations (ekheap t) (kheap t) (ksPSpace s''); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''\<rbrakk> \<Longrightarrow> mdb_insert_abs (cdt a) src dest
 2. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), s'') \<in> fst (updateCap (cte_map dest) c' b); ((), s''a) \<in> fst (updateMDB (cte_map dest) (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) s''); ((), s''b) \<in> fst (updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest)) s''a); ((), ba) \<in> fst (updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest)) s''b); ((), t) \<in> fst (set_cap c dest a); pspace_relations (ekheap t) (kheap t) (ksPSpace s''); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; mdb_insert_abs (cdt a) src dest\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
y <- update_cdt (\<lambda>cdt. cdt(dest := if should_be_parent_of src_cap (is_original src) c (revokable src_cap c) then Some src else cdt src));
y <- cap_insert_ext (should_be_parent_of src_cap (is_original src) c (revokable src_cap c)) src dest src_p dest_p;
set_original dest (revokable src_cap c)
od) t). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 4. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 8. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 10. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_list a; src \<noteq> dest; caps_of_state a dest = Some cap.NullCap; is_simple_cap c; safe_parent_for (cdt a) src c src_cap; caps_of_state a src = Some (masked_as_full src_cap c); pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), s'') \<in> fst (updateCap (cte_map dest) c' b); ((), s''a) \<in> fst (updateMDB (cte_map dest) (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) s''); ((), s''b) \<in> fst (updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest)) s''a); ((), ba) \<in> fst (updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest)) s''b); ((), t) \<in> fst (set_cap c dest a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state a p = Some c \<and> cap.NullCap \<noteq> c) (cdt a); untyped_mdb (cdt a) (caps_of_state a); descendants_inc (cdt a) (caps_of_state a); no_mloop (cdt a); untyped_inc (cdt a) (caps_of_state a); ut_revocable (is_original_cap a) (caps_of_state a); irq_revocable (is_original_cap a) (caps_of_state a); reply_master_revocable (is_original_cap a) (caps_of_state a); reply_mdb (cdt a) (caps_of_state a)\<rbrakk> \<Longrightarrow> mdb_insert_abs (cdt a) src dest
 2. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), s'') \<in> fst (updateCap (cte_map dest) c' b); ((), s''a) \<in> fst (updateMDB (cte_map dest) (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) s''); ((), s''b) \<in> fst (updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest)) s''a); ((), ba) \<in> fst (updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest)) s''b); ((), t) \<in> fst (set_cap c dest a); pspace_relations (ekheap t) (kheap t) (ksPSpace s''); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; mdb_insert_abs (cdt a) src dest\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
y <- update_cdt (\<lambda>cdt. cdt(dest := if should_be_parent_of src_cap (is_original src) c (revokable src_cap c) then Some src else cdt src));
y <- cap_insert_ext (should_be_parent_of src_cap (is_original src) c (revokable src_cap c)) src dest src_p dest_p;
set_original dest (revokable src_cap c)
od) t). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 4. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 8. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 10. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
A total of 12 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_list a; src \<noteq> dest; caps_of_state a dest = Some cap.NullCap; is_simple_cap c; safe_parent_for (cdt a) src c src_cap; caps_of_state a src = Some (masked_as_full src_cap c); pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), s'') \<in> fst (updateCap (cte_map dest) c' b); ((), s''a) \<in> fst (updateMDB (cte_map dest) (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) s''); ((), s''b) \<in> fst (updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest)) s''a); ((), ba) \<in> fst (updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest)) s''b); ((), t) \<in> fst (set_cap c dest a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state a p = Some c \<and> cap.NullCap \<noteq> c) (cdt a); untyped_mdb (cdt a) (caps_of_state a); descendants_inc (cdt a) (caps_of_state a); no_mloop (cdt a); untyped_inc (cdt a) (caps_of_state a); ut_revocable (is_original_cap a) (caps_of_state a); irq_revocable (is_original_cap a) (caps_of_state a); reply_master_revocable (is_original_cap a) (caps_of_state a); reply_mdb (cdt a) (caps_of_state a)\<rbrakk> \<Longrightarrow> src \<noteq> dest
 2. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_list a; src \<noteq> dest; caps_of_state a dest = Some cap.NullCap; is_simple_cap c; safe_parent_for (cdt a) src c src_cap; caps_of_state a src = Some (masked_as_full src_cap c); pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), s'') \<in> fst (updateCap (cte_map dest) c' b); ((), s''a) \<in> fst (updateMDB (cte_map dest) (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) s''); ((), s''b) \<in> fst (updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest)) s''a); ((), ba) \<in> fst (updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest)) s''b); ((), t) \<in> fst (set_cap c dest a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state a p = Some c \<and> cap.NullCap \<noteq> c) (cdt a); untyped_mdb (cdt a) (caps_of_state a); descendants_inc (cdt a) (caps_of_state a); no_mloop (cdt a); untyped_inc (cdt a) (caps_of_state a); ut_revocable (is_original_cap a) (caps_of_state a); irq_revocable (is_original_cap a) (caps_of_state a); reply_master_revocable (is_original_cap a) (caps_of_state a); reply_mdb (cdt a) (caps_of_state a)\<rbrakk> \<Longrightarrow> cdt a dest = None
 3. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_list a; src \<noteq> dest; caps_of_state a dest = Some cap.NullCap; is_simple_cap c; safe_parent_for (cdt a) src c src_cap; caps_of_state a src = Some (masked_as_full src_cap c); pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), s'') \<in> fst (updateCap (cte_map dest) c' b); ((), s''a) \<in> fst (updateMDB (cte_map dest) (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) s''); ((), s''b) \<in> fst (updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest)) s''a); ((), ba) \<in> fst (updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest)) s''b); ((), t) \<in> fst (set_cap c dest a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state a p = Some c \<and> cap.NullCap \<noteq> c) (cdt a); untyped_mdb (cdt a) (caps_of_state a); descendants_inc (cdt a) (caps_of_state a); no_mloop (cdt a); untyped_inc (cdt a) (caps_of_state a); ut_revocable (is_original_cap a) (caps_of_state a); irq_revocable (is_original_cap a) (caps_of_state a); reply_master_revocable (is_original_cap a) (caps_of_state a); reply_mdb (cdt a) (caps_of_state a)\<rbrakk> \<Longrightarrow> descendants_of dest (cdt a) = {}
 4. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), s'') \<in> fst (updateCap (cte_map dest) c' b); ((), s''a) \<in> fst (updateMDB (cte_map dest) (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) s''); ((), s''b) \<in> fst (updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest)) s''a); ((), ba) \<in> fst (updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest)) s''b); ((), t) \<in> fst (set_cap c dest a); pspace_relations (ekheap t) (kheap t) (ksPSpace s''); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; mdb_insert_abs (cdt a) src dest\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
y <- update_cdt (\<lambda>cdt. cdt(dest := if should_be_parent_of src_cap (is_original src) c (revokable src_cap c) then Some src else cdt src));
y <- cap_insert_ext (should_be_parent_of src_cap (is_original src) c (revokable src_cap c)) src dest src_p dest_p;
set_original dest (revokable src_cap c)
od) t). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 5. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 6. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 7. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 8. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 9. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 10. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_list a; src \<noteq> dest; caps_of_state a dest = Some cap.NullCap; is_simple_cap c; safe_parent_for (cdt a) src c src_cap; caps_of_state a src = Some (masked_as_full src_cap c); pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), s'') \<in> fst (updateCap (cte_map dest) c' b); ((), s''a) \<in> fst (updateMDB (cte_map dest) (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) s''); ((), s''b) \<in> fst (updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest)) s''a); ((), ba) \<in> fst (updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest)) s''b); ((), t) \<in> fst (set_cap c dest a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state a p = Some c \<and> cap.NullCap \<noteq> c) (cdt a); untyped_mdb (cdt a) (caps_of_state a); descendants_inc (cdt a) (caps_of_state a); no_mloop (cdt a); untyped_inc (cdt a) (caps_of_state a); ut_revocable (is_original_cap a) (caps_of_state a); irq_revocable (is_original_cap a) (caps_of_state a); reply_master_revocable (is_original_cap a) (caps_of_state a); reply_mdb (cdt a) (caps_of_state a)\<rbrakk> \<Longrightarrow> cdt a dest = None
 2. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_list a; src \<noteq> dest; caps_of_state a dest = Some cap.NullCap; is_simple_cap c; safe_parent_for (cdt a) src c src_cap; caps_of_state a src = Some (masked_as_full src_cap c); pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), s'') \<in> fst (updateCap (cte_map dest) c' b); ((), s''a) \<in> fst (updateMDB (cte_map dest) (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) s''); ((), s''b) \<in> fst (updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest)) s''a); ((), ba) \<in> fst (updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest)) s''b); ((), t) \<in> fst (set_cap c dest a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state a p = Some c \<and> cap.NullCap \<noteq> c) (cdt a); untyped_mdb (cdt a) (caps_of_state a); descendants_inc (cdt a) (caps_of_state a); no_mloop (cdt a); untyped_inc (cdt a) (caps_of_state a); ut_revocable (is_original_cap a) (caps_of_state a); irq_revocable (is_original_cap a) (caps_of_state a); reply_master_revocable (is_original_cap a) (caps_of_state a); reply_mdb (cdt a) (caps_of_state a)\<rbrakk> \<Longrightarrow> descendants_of dest (cdt a) = {}
 3. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), s'') \<in> fst (updateCap (cte_map dest) c' b); ((), s''a) \<in> fst (updateMDB (cte_map dest) (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) s''); ((), s''b) \<in> fst (updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest)) s''a); ((), ba) \<in> fst (updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest)) s''b); ((), t) \<in> fst (set_cap c dest a); pspace_relations (ekheap t) (kheap t) (ksPSpace s''); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; mdb_insert_abs (cdt a) src dest\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
y <- update_cdt (\<lambda>cdt. cdt(dest := if should_be_parent_of src_cap (is_original src) c (revokable src_cap c) then Some src else cdt src));
y <- cap_insert_ext (should_be_parent_of src_cap (is_original src) c (revokable src_cap c)) src dest src_p dest_p;
set_original dest (revokable src_cap c)
od) t). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 4. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 5. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 6. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 7. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 8. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 9. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 10. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_list a; src \<noteq> dest; caps_of_state a dest = Some cap.NullCap; is_simple_cap c; safe_parent_for (cdt a) src c src_cap; caps_of_state a src = Some (masked_as_full src_cap c); pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), s'') \<in> fst (updateCap (cte_map dest) c' b); ((), s''a) \<in> fst (updateMDB (cte_map dest) (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) s''); ((), s''b) \<in> fst (updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest)) s''a); ((), ba) \<in> fst (updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest)) s''b); ((), t) \<in> fst (set_cap c dest a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state a p = Some c \<and> cap.NullCap \<noteq> c) (cdt a); untyped_mdb (cdt a) (caps_of_state a); descendants_inc (cdt a) (caps_of_state a); no_mloop (cdt a); untyped_inc (cdt a) (caps_of_state a); ut_revocable (is_original_cap a) (caps_of_state a); irq_revocable (is_original_cap a) (caps_of_state a); reply_master_revocable (is_original_cap a) (caps_of_state a); reply_mdb (cdt a) (caps_of_state a)\<rbrakk> \<Longrightarrow> descendants_of dest (cdt a) = {}
 2. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), s'') \<in> fst (updateCap (cte_map dest) c' b); ((), s''a) \<in> fst (updateMDB (cte_map dest) (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) s''); ((), s''b) \<in> fst (updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest)) s''a); ((), ba) \<in> fst (updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest)) s''b); ((), t) \<in> fst (set_cap c dest a); pspace_relations (ekheap t) (kheap t) (ksPSpace s''); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; mdb_insert_abs (cdt a) src dest\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
y <- update_cdt (\<lambda>cdt. cdt(dest := if should_be_parent_of src_cap (is_original src) c (revokable src_cap c) then Some src else cdt src));
y <- cap_insert_ext (should_be_parent_of src_cap (is_original src) c (revokable src_cap c)) src dest src_p dest_p;
set_original dest (revokable src_cap c)
od) t). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 4. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 8. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 10. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), s'') \<in> fst (updateCap (cte_map dest) c' b); ((), s''a) \<in> fst (updateMDB (cte_map dest) (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) s''); ((), s''b) \<in> fst (updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest)) s''a); ((), ba) \<in> fst (updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest)) s''b); ((), t) \<in> fst (set_cap c dest a); pspace_relations (ekheap t) (kheap t) (ksPSpace s''); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; mdb_insert_abs (cdt a) src dest\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
y <- update_cdt (\<lambda>cdt. cdt(dest := if should_be_parent_of src_cap (is_original src) c (revokable src_cap c) then Some src else cdt src));
y <- cap_insert_ext (should_be_parent_of src_cap (is_original src) c (revokable src_cap c)) src dest src_p dest_p;
set_original dest (revokable src_cap c)
od) t). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), s'') \<in> fst (updateCap (cte_map dest) c' b); ((), s''a) \<in> fst (updateMDB (cte_map dest) (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) s''); ((), s''b) \<in> fst (updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest)) s''a); ((), ba) \<in> fst (updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest)) s''b); ((), t) \<in> fst (set_cap c dest a); pspace_relations (ekheap t) (kheap t) (ksPSpace s''); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
y <- update_cdt (\<lambda>cdt. cdt(dest := if should_be_parent_of src_cap (is_original src) c (revokable src_cap c) then Some src else cdt src));
y <- cap_insert_ext (should_be_parent_of src_cap (is_original src) c (revokable src_cap c)) src dest src_p dest_p;
set_original dest (revokable src_cap c)
od) t). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 2. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), s'') \<in> fst (updateCap (cte_map dest) c' b); ((), s''a) \<in> fst (updateMDB (cte_map dest) (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) s''); ((), s''b) \<in> fst (updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest)) s''a); ((), ba) \<in> fst (updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest)) s''b); ((), t) \<in> fst (set_cap c dest a); pspace_relations (ekheap t) (kheap t) (ksPSpace s''); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; mdb_insert_abs (cdt a) src dest\<rbrakk> \<Longrightarrow> no_mloop (cdt a)
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 4. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 8. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 10. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), s'') \<in> fst (updateCap (cte_map dest) c' b); ((), s''a) \<in> fst (updateMDB (cte_map dest) (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) s''); ((), s''b) \<in> fst (updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest)) s''a); ((), ba) \<in> fst (updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest)) s''b); ((), t) \<in> fst (set_cap c dest a); pspace_relations (ekheap t) (kheap t) (ksPSpace s''); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; mdb_insert_abs (cdt a) src dest\<rbrakk> \<Longrightarrow> no_mloop (cdt a)
 2. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), s'') \<in> fst (updateCap (cte_map dest) c' b); ((), s''a) \<in> fst (updateMDB (cte_map dest) (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) s''); ((), s''b) \<in> fst (updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest)) s''a); ((), ba) \<in> fst (updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest)) s''b); ((), t) \<in> fst (set_cap c dest a); pspace_relations (ekheap t) (kheap t) (ksPSpace s''); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
y <- update_cdt (\<lambda>cdt. cdt(dest := if should_be_parent_of src_cap (is_original src) c (revokable src_cap c) then Some src else cdt src));
y <- cap_insert_ext (should_be_parent_of src_cap (is_original src) c (revokable src_cap c)) src dest src_p dest_p;
set_original dest (revokable src_cap c)
od) t). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 4. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 8. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 10. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), s'') \<in> fst (updateCap (cte_map dest) c' b); ((), s''a) \<in> fst (updateMDB (cte_map dest) (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) s''); ((), s''b) \<in> fst (updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest)) s''a); ((), ba) \<in> fst (updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest)) s''b); ((), t) \<in> fst (set_cap c dest a); pspace_relations (ekheap t) (kheap t) (ksPSpace s''); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
y <- update_cdt (\<lambda>cdt. cdt(dest := if should_be_parent_of src_cap (is_original src) c (revokable src_cap c) then Some src else cdt src));
y <- cap_insert_ext (should_be_parent_of src_cap (is_original src) c (revokable src_cap c)) src dest src_p dest_p;
set_original dest (revokable src_cap c)
od) t). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), s'') \<in> fst (updateCap (cte_map dest) c' b); ((), s''a) \<in> fst (updateMDB (cte_map dest) (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) s''); ((), s''b) \<in> fst (updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest)) s''a); ((), ba) \<in> fst (updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest)) s''b); ((), t) \<in> fst (set_cap c dest a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (put (t\<lparr>cdt_list := case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest), cdt := (cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src), is_original_cap := (is_original_cap a)(dest := revokable src_cap c)\<rparr>) (t\<lparr>cdt_list := case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest), cdt := (cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)\<rparr>)). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), s'') \<in> fst (updateCap (cte_map dest) c' b); ((), s''a) \<in> fst (updateMDB (cte_map dest) (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) s''); ((), s''b) \<in> fst (updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest)) s''a); ((), ba) \<in> fst (updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest)) s''b); ((), t) \<in> fst (set_cap c dest a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a)\<rbrakk> \<Longrightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> sched_act_relation (scheduler_action a) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues a) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (ctes_of ba) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (ctes_of ba) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> ksCurThread s'' = ksCurThread ba \<and> ksIdleThread s'' = ksIdleThread ba \<and> ksMachineState s'' = ksMachineState ba \<and> ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted ba \<and> ksDomScheduleIdx s'' = ksDomScheduleIdx ba \<and> ksDomSchedule s'' = ksDomSchedule ba \<and> ksCurDomain s'' = ksCurDomain ba \<and> ksDomainTime s'' = ksDomainTime ba
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), s''a) \<in> fst (updateMDB (cte_map dest) (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) s''); ((), s''b) \<in> fst (updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest)) s''a); ((), ba) \<in> fst (updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest)) s''b); ((), t) \<in> fst (set_cap c dest a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState s'') \<in> arch_state_relation; cur_thread t = ksCurThread s''; idle_thread t = ksIdleThread s''; machine_state t = ksMachineState s''; work_units_completed t = ksWorkUnitsCompleted s''; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); ctes_of s'' = modify_map (ctes_of b) (cte_map dest) (cteCap_update (K c')) \<and> gsUserPages s'' = gsUserPages b \<and> gsCNodes s'' = gsCNodes b \<and> ksMachineState s'' = ksMachineState b \<and> ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b \<and> ksCurThread s'' = ksCurThread b \<and> ksIdleThread s'' = ksIdleThread b \<and> ksReadyQueues s'' = ksReadyQueues b \<and> ksSchedulerAction s'' = ksSchedulerAction b \<and> ksArchState s'' = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' s'') \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' s'')\<rbrakk> \<Longrightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> sched_act_relation (scheduler_action a) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues a) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (ctes_of ba) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (ctes_of ba) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> ksCurThread s'' = ksCurThread ba \<and> ksIdleThread s'' = ksIdleThread ba \<and> ksMachineState s'' = ksMachineState ba \<and> ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted ba \<and> ksDomScheduleIdx s'' = ksDomScheduleIdx ba \<and> ksDomSchedule s'' = ksDomSchedule ba \<and> ksCurDomain s'' = ksCurDomain ba \<and> ksDomainTime s'' = ksDomainTime ba
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), s''a) \<in> fst (updateMDB (cte_map dest) (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) s''); ((), s''b) \<in> fst (updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest)) s''a); ((), ba) \<in> fst (updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest)) s''b); ((), t) \<in> fst (set_cap c dest a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); ctes_of s'' = modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c')); gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''\<rbrakk> \<Longrightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> sched_act_relation (scheduler_action a) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues a) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (ctes_of ba) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (ctes_of ba) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> ksCurThread b = ksCurThread ba \<and> ksIdleThread b = ksIdleThread ba \<and> ksMachineState b = ksMachineState ba \<and> ksWorkUnitsCompleted b = ksWorkUnitsCompleted ba \<and> ksDomScheduleIdx s'' = ksDomScheduleIdx ba \<and> ksDomSchedule s'' = ksDomSchedule ba \<and> ksCurDomain s'' = ksCurDomain ba \<and> ksDomainTime s'' = ksDomainTime ba
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), s''b) \<in> fst (updateMDB (cte_map src) (mdbNext_update (\<lambda>_. cte_map dest)) s''a); ((), ba) \<in> fst (updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest)) s''b); ((), t) \<in> fst (set_cap c dest a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); ctes_of s'' = modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c')); gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; ctes_of s''a = modify_map (ctes_of s'') (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))); ksMachineState s''a = ksMachineState s''; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted s''; ksCurThread s''a = ksCurThread s''; ksIdleThread s''a = ksIdleThread s''; ksReadyQueues s''a = ksReadyQueues s''; ksSchedulerAction s''a = ksSchedulerAction s''; ksInterruptState s''a = ksInterruptState s''; ksArchState s''a = ksArchState s''; gsUserPages s''a = gsUserPages s''; gsCNodes s''a = gsCNodes s''; pspace_relations (ekheap t) (kheap t) (ksPSpace s''a); pspace_aligned' s''a; pspace_distinct' s''a; no_0 (ctes_of s''a); ksDomScheduleIdx s''a = ksDomScheduleIdx s''; ksDomSchedule s''a = ksDomSchedule s''; ksCurDomain s''a = ksCurDomain s''; ksDomainTime s''a = ksDomainTime s''\<rbrakk> \<Longrightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> sched_act_relation (scheduler_action a) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues a) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (ctes_of ba) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (ctes_of ba) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> ksCurThread b = ksCurThread ba \<and> ksIdleThread b = ksIdleThread ba \<and> ksMachineState b = ksMachineState ba \<and> ksWorkUnitsCompleted b = ksWorkUnitsCompleted ba \<and> ksDomScheduleIdx s'' = ksDomScheduleIdx ba \<and> ksDomSchedule s'' = ksDomSchedule ba \<and> ksCurDomain s'' = ksCurDomain ba \<and> ksDomainTime s'' = ksDomainTime ba
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), ba) \<in> fst (updateMDB (mdbNext (cteMDBNode srcCTE)) (mdbPrev_update (\<lambda>_. cte_map dest)) s''b); ((), t) \<in> fst (set_cap c dest a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); ctes_of s'' = modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c')); gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; ctes_of s''a = modify_map (ctes_of s'') (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))); ksMachineState s''a = ksMachineState s''; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted s''; ksCurThread s''a = ksCurThread s''; ksIdleThread s''a = ksIdleThread s''; ksReadyQueues s''a = ksReadyQueues s''; ksSchedulerAction s''a = ksSchedulerAction s''; ksInterruptState s''a = ksInterruptState s''; ksArchState s''a = ksArchState s''; gsUserPages s''a = gsUserPages s''; gsCNodes s''a = gsCNodes s''; pspace_relations (ekheap t) (kheap t) (ksPSpace s''a); pspace_aligned' s''a; pspace_distinct' s''a; no_0 (ctes_of s''a); ksDomScheduleIdx s''a = ksDomScheduleIdx s''; ksDomSchedule s''a = ksDomSchedule s''; ksCurDomain s''a = ksCurDomain s''; ksDomainTime s''a = ksDomainTime s''; ctes_of s''b = modify_map (ctes_of s''a) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest))); ksMachineState s''b = ksMachineState s''a; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted s''a; ksCurThread s''b = ksCurThread s''a; ksIdleThread s''b = ksIdleThread s''a; ksReadyQueues s''b = ksReadyQueues s''a; ksSchedulerAction s''b = ksSchedulerAction s''a; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState s''a; gsUserPages s''b = gsUserPages s''a; gsCNodes s''b = gsCNodes s''a; pspace_relations (ekheap t) (kheap t) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; no_0 (ctes_of s''b); ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a\<rbrakk> \<Longrightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> sched_act_relation (scheduler_action a) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues a) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (ctes_of ba) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (ctes_of ba) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> ksCurThread b = ksCurThread ba \<and> ksIdleThread b = ksIdleThread ba \<and> ksMachineState b = ksMachineState ba \<and> ksWorkUnitsCompleted b = ksWorkUnitsCompleted ba \<and> ksDomScheduleIdx s'' = ksDomScheduleIdx ba \<and> ksDomSchedule s'' = ksDomSchedule ba \<and> ksCurDomain s'' = ksCurDomain ba \<and> ksDomainTime s'' = ksDomainTime ba
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); ctes_of s'' = modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c')); gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; ctes_of s''a = modify_map (ctes_of s'') (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))); ksMachineState s''a = ksMachineState s''; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted s''; ksCurThread s''a = ksCurThread s''; ksIdleThread s''a = ksIdleThread s''; ksReadyQueues s''a = ksReadyQueues s''; ksSchedulerAction s''a = ksSchedulerAction s''; ksInterruptState s''a = ksInterruptState s''; ksArchState s''a = ksArchState s''; gsUserPages s''a = gsUserPages s''; gsCNodes s''a = gsCNodes s''; pspace_relations (ekheap t) (kheap t) (ksPSpace s''a); pspace_aligned' s''a; pspace_distinct' s''a; no_0 (ctes_of s''a); ksDomScheduleIdx s''a = ksDomScheduleIdx s''; ksDomSchedule s''a = ksDomSchedule s''; ksCurDomain s''a = ksCurDomain s''; ksDomainTime s''a = ksDomainTime s''; ctes_of s''b = modify_map (ctes_of s''a) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest))); ksMachineState s''b = ksMachineState s''a; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted s''a; ksCurThread s''b = ksCurThread s''a; ksIdleThread s''b = ksIdleThread s''a; ksReadyQueues s''b = ksReadyQueues s''a; ksSchedulerAction s''b = ksSchedulerAction s''a; ksInterruptState s''b = ksInterruptState s''a; ksArchState s''b = ksArchState s''a; gsUserPages s''b = gsUserPages s''a; gsCNodes s''b = gsCNodes s''a; pspace_relations (ekheap t) (kheap t) (ksPSpace s''b); pspace_aligned' s''b; pspace_distinct' s''b; no_0 (ctes_of s''b); ksDomScheduleIdx s''b = ksDomScheduleIdx s''a; ksDomSchedule s''b = ksDomSchedule s''a; ksCurDomain s''b = ksCurDomain s''a; ksDomainTime s''b = ksDomainTime s''a; ctes_of ba = modify_map (ctes_of s''b) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))); ksMachineState ba = ksMachineState s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted s''b; ksCurThread ba = ksCurThread s''b; ksIdleThread ba = ksIdleThread s''b; ksReadyQueues ba = ksReadyQueues s''b; ksSchedulerAction ba = ksSchedulerAction s''b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState s''b; gsUserPages ba = gsUserPages s''b; gsCNodes ba = gsCNodes s''b; pspace_relations (ekheap t) (kheap t) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; no_0 (ctes_of ba); ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b\<rbrakk> \<Longrightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> sched_act_relation (scheduler_action a) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues a) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (ctes_of ba) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (ctes_of ba) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> ksCurThread b = ksCurThread ba \<and> ksIdleThread b = ksIdleThread ba \<and> ksMachineState b = ksMachineState ba \<and> ksWorkUnitsCompleted b = ksWorkUnitsCompleted ba \<and> ksDomScheduleIdx s'' = ksDomScheduleIdx ba \<and> ksDomSchedule s'' = ksDomSchedule ba \<and> ksCurDomain s'' = ksCurDomain ba \<and> ksDomainTime s'' = ksDomainTime ba
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); ctes_of s'' = modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c')); gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; ctes_of s''a = modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState s''; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx s''; ksDomSchedule s''a = ksDomSchedule s''; ksCurDomain s''a = ksCurDomain s''; ksDomainTime s''a = ksDomainTime s''; ctes_of s''b = modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest))); ksMachineState s''b = ksMachineState b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksCurThread s''b = ksCurThread b; ksIdleThread s''b = ksIdleThread b; ksReadyQueues s''b = ksReadyQueues b; ksSchedulerAction s''b = ksSchedulerAction b; ksInterruptState s''b = ksInterruptState s''; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''; ksDomSchedule s''b = ksDomSchedule s''; ksCurDomain s''b = ksCurDomain s''; ksDomainTime s''b = ksDomainTime s''; ctes_of ba = modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))); ksMachineState ba = ksMachineState b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksCurThread ba = ksCurThread b; ksIdleThread ba = ksIdleThread b; ksReadyQueues ba = ksReadyQueues b; ksSchedulerAction ba = ksSchedulerAction b; ksInterruptState ba = ksInterruptState s''; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''; ksDomSchedule ba = ksDomSchedule s''; ksCurDomain ba = ksCurDomain s''; ksDomainTime ba = ksDomainTime s''; pspace_relation (kheap t) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); ctes_of s'' = modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c')); gsUserPages s'' = gsUserPages b; ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; ctes_of s''a = modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState s''; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx s''; ksDomSchedule s''a = ksDomSchedule s''; ksCurDomain s''a = ksCurDomain s''; ksDomainTime s''a = ksDomainTime s''; ctes_of s''b = modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest))); ksMachineState s''b = ksMachineState b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksCurThread s''b = ksCurThread b; ksIdleThread s''b = ksIdleThread b; ksReadyQueues s''b = ksReadyQueues b; ksSchedulerAction s''b = ksSchedulerAction b; ksInterruptState s''b = ksInterruptState s''; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''; ksDomSchedule s''b = ksDomSchedule s''; ksCurDomain s''b = ksCurDomain s''; ksDomainTime s''b = ksDomainTime s''; ctes_of ba = modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))); ksMachineState ba = ksMachineState b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksCurThread ba = ksCurThread b; ksIdleThread ba = ksIdleThread b; ksReadyQueues ba = ksReadyQueues b; ksSchedulerAction ba = ksSchedulerAction b; ksInterruptState ba = ksInterruptState s''; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''; ksDomSchedule ba = ksDomSchedule s''; ksCurDomain ba = ksCurDomain s''; ksDomainTime ba = ksDomainTime s''; pspace_relation (kheap t) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); ctes_of s'' = modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c')); gsUserPages s'' = gsUserPages b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; ctes_of s''a = modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))); ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState s''; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx s''; ksDomSchedule s''a = ksDomSchedule s''; ksCurDomain s''a = ksCurDomain s''; ksDomainTime s''a = ksDomainTime s''; ctes_of s''b = modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest))); ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksCurThread s''b = ksCurThread b; ksIdleThread s''b = ksIdleThread b; ksReadyQueues s''b = ksReadyQueues b; ksSchedulerAction s''b = ksSchedulerAction b; ksInterruptState s''b = ksInterruptState s''; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''; ksDomSchedule s''b = ksDomSchedule s''; ksCurDomain s''b = ksCurDomain s''; ksDomainTime s''b = ksDomainTime s''; ctes_of ba = modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))); ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksCurThread ba = ksCurThread b; ksIdleThread ba = ksIdleThread b; ksReadyQueues ba = ksReadyQueues b; ksSchedulerAction ba = ksSchedulerAction b; ksInterruptState ba = ksInterruptState s''; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''; ksDomSchedule ba = ksDomSchedule s''; ksCurDomain ba = ksCurDomain s''; ksDomainTime ba = ksDomainTime s''; pspace_relation (kheap t) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); ctes_of s'' = modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c')); gsUserPages s'' = gsUserPages b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; ctes_of s''a = modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))); ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState s''; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx s''; ksDomSchedule s''a = ksDomSchedule s''; ksCurDomain s''a = ksCurDomain s''; ksDomainTime s''a = ksDomainTime s''; ctes_of s''b = modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest))); ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksReadyQueues s''b = ksReadyQueues b; ksSchedulerAction s''b = ksSchedulerAction b; ksInterruptState s''b = ksInterruptState s''; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''; ksDomSchedule s''b = ksDomSchedule s''; ksCurDomain s''b = ksCurDomain s''; ksDomainTime s''b = ksDomainTime s''; ctes_of ba = modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))); ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksReadyQueues ba = ksReadyQueues b; ksSchedulerAction ba = ksSchedulerAction b; ksInterruptState ba = ksInterruptState s''; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''; ksDomSchedule ba = ksDomSchedule s''; ksCurDomain ba = ksCurDomain s''; ksDomainTime ba = ksDomainTime s''; pspace_relation (kheap t) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); ctes_of s'' = modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c')); gsUserPages s'' = gsUserPages b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; ctes_of s''a = modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))); ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState s''; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx s''; ksDomSchedule s''a = ksDomSchedule s''; ksCurDomain s''a = ksCurDomain s''; ksDomainTime s''a = ksDomainTime s''; ctes_of s''b = modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest))); ksIdleThread s''b = ksIdleThread b; ksReadyQueues s''b = ksReadyQueues b; ksSchedulerAction s''b = ksSchedulerAction b; ksInterruptState s''b = ksInterruptState s''; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''; ksDomSchedule s''b = ksDomSchedule s''; ksCurDomain s''b = ksCurDomain s''; ksDomainTime s''b = ksDomainTime s''; ctes_of ba = modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))); ksIdleThread ba = ksIdleThread b; ksReadyQueues ba = ksReadyQueues b; ksSchedulerAction ba = ksSchedulerAction b; ksInterruptState ba = ksInterruptState s''; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''; ksDomSchedule ba = ksDomSchedule s''; ksCurDomain ba = ksCurDomain s''; ksDomainTime ba = ksDomainTime s''; pspace_relation (kheap t) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); ctes_of s'' = modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c')); gsUserPages s'' = gsUserPages b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; ctes_of s''a = modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))); ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState s''; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx s''; ksDomSchedule s''a = ksDomSchedule s''; ksCurDomain s''a = ksCurDomain s''; ksDomainTime s''a = ksDomainTime s''; ctes_of s''b = modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest))); ksReadyQueues s''b = ksReadyQueues b; ksSchedulerAction s''b = ksSchedulerAction b; ksInterruptState s''b = ksInterruptState s''; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''; ksDomSchedule s''b = ksDomSchedule s''; ksCurDomain s''b = ksCurDomain s''; ksDomainTime s''b = ksDomainTime s''; ctes_of ba = modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))); ksReadyQueues ba = ksReadyQueues b; ksSchedulerAction ba = ksSchedulerAction b; ksInterruptState ba = ksInterruptState s''; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''; ksDomSchedule ba = ksDomSchedule s''; ksCurDomain ba = ksCurDomain s''; ksDomainTime ba = ksDomainTime s''; pspace_relation (kheap t) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); ctes_of s'' = modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c')); gsUserPages s'' = gsUserPages b; ksSchedulerAction s'' = ksSchedulerAction b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; ctes_of s''a = modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))); ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState s''; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx s''; ksDomSchedule s''a = ksDomSchedule s''; ksCurDomain s''a = ksCurDomain s''; ksDomainTime s''a = ksDomainTime s''; ctes_of s''b = modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest))); ksSchedulerAction s''b = ksSchedulerAction b; ksInterruptState s''b = ksInterruptState s''; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''; ksDomSchedule s''b = ksDomSchedule s''; ksCurDomain s''b = ksCurDomain s''; ksDomainTime s''b = ksDomainTime s''; ctes_of ba = modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))); ksSchedulerAction ba = ksSchedulerAction b; ksInterruptState ba = ksInterruptState s''; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''; ksDomSchedule ba = ksDomSchedule s''; ksCurDomain ba = ksCurDomain s''; ksDomainTime ba = ksDomainTime s''; pspace_relation (kheap t) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); ctes_of s'' = modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c')); gsUserPages s'' = gsUserPages b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; ctes_of s''a = modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))); ksInterruptState s''a = ksInterruptState s''; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx s''; ksDomSchedule s''a = ksDomSchedule s''; ksCurDomain s''a = ksCurDomain s''; ksDomainTime s''a = ksDomainTime s''; ctes_of s''b = modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest))); ksInterruptState s''b = ksInterruptState s''; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''; ksDomSchedule s''b = ksDomSchedule s''; ksCurDomain s''b = ksCurDomain s''; ksDomainTime s''b = ksDomainTime s''; ctes_of ba = modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))); ksInterruptState ba = ksInterruptState s''; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''; ksDomSchedule ba = ksDomSchedule s''; ksCurDomain ba = ksCurDomain s''; ksDomainTime ba = ksDomainTime s''; pspace_relation (kheap t) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); ctes_of s'' = modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c')); gsUserPages s'' = gsUserPages b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; ctes_of s''a = modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))); ksInterruptState s''a = ksInterruptState s''; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx s''; ksDomSchedule s''a = ksDomSchedule s''; ksCurDomain s''a = ksCurDomain s''; ksDomainTime s''a = ksDomainTime s''; ctes_of s''b = modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest))); ksInterruptState s''b = ksInterruptState s''; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''; ksDomSchedule s''b = ksDomSchedule s''; ksCurDomain s''b = ksCurDomain s''; ksDomainTime s''b = ksDomainTime s''; ctes_of ba = modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))); ksInterruptState ba = ksInterruptState s''; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''; ksDomSchedule ba = ksDomSchedule s''; ksCurDomain ba = ksCurDomain s''; ksDomainTime ba = ksDomainTime s''; pspace_relation (kheap t) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; domain_time t = ksDomainTime s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); ctes_of s'' = modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c')); gsUserPages s'' = gsUserPages b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; ctes_of s''a = modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))); ksInterruptState s''a = ksInterruptState s''; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx s''; ksDomSchedule s''a = ksDomSchedule s''; ksCurDomain s''a = ksCurDomain s''; ksDomainTime s''a = ksDomainTime s''; ctes_of s''b = modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest))); ksInterruptState s''b = ksInterruptState s''; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''; ksDomSchedule s''b = ksDomSchedule s''; ksCurDomain s''b = ksCurDomain s''; ksDomainTime s''b = ksDomainTime s''; ctes_of ba = modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))); ksInterruptState ba = ksInterruptState s''; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''; ksDomSchedule ba = ksDomSchedule s''; ksCurDomain ba = ksCurDomain s''; ksDomainTime ba = ksDomainTime s''; pspace_relation (kheap t) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_list t = ksDomSchedule s''; cur_domain t = ksCurDomain s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); ctes_of s'' = modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c')); gsUserPages s'' = gsUserPages b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; ctes_of s''a = modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))); ksInterruptState s''a = ksInterruptState s''; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx s''; ksDomSchedule s''a = ksDomSchedule s''; ksCurDomain s''a = ksCurDomain s''; ksDomainTime s''a = ksDomainTime s''; ctes_of s''b = modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest))); ksInterruptState s''b = ksInterruptState s''; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''; ksDomSchedule s''b = ksDomSchedule s''; ksCurDomain s''b = ksCurDomain s''; ksDomainTime s''b = ksDomainTime s''; ctes_of ba = modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))); ksInterruptState ba = ksInterruptState s''; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''; ksDomSchedule ba = ksDomSchedule s''; ksCurDomain ba = ksCurDomain s''; ksDomainTime ba = ksDomainTime s''; pspace_relation (kheap t) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); ctes_of s'' = modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c')); gsUserPages s'' = gsUserPages b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; ctes_of s''a = modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))); ksInterruptState s''a = ksInterruptState s''; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx s''; ksDomSchedule s''a = ksDomSchedule s''; ksCurDomain s''a = ksCurDomain s''; ksDomainTime s''a = ksDomainTime s''; ctes_of s''b = modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest))); ksInterruptState s''b = ksInterruptState s''; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''; ksDomSchedule s''b = ksDomSchedule s''; ksCurDomain s''b = ksCurDomain s''; ksDomainTime s''b = ksDomainTime s''; ctes_of ba = modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))); ksInterruptState ba = ksInterruptState s''; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''; ksDomSchedule ba = ksDomSchedule s''; ksCurDomain ba = ksCurDomain s''; ksDomainTime ba = ksDomainTime s''; pspace_relation (kheap t) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); ctes_of s'' = modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c')); gsUserPages s'' = gsUserPages b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; ctes_of s''a = modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))); ksInterruptState s''a = ksInterruptState s''; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx s''; ksDomSchedule s''a = ksDomSchedule s''; ksCurDomain s''a = ksCurDomain s''; ksDomainTime s''a = ksDomainTime s''; ctes_of s''b = modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest))); ksInterruptState s''b = ksInterruptState s''; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''; ksDomSchedule s''b = ksDomSchedule s''; ksCurDomain s''b = ksCurDomain s''; ksDomainTime s''b = ksDomainTime s''; ctes_of ba = modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))); ksInterruptState ba = ksInterruptState s''; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''; ksDomSchedule ba = ksDomSchedule s''; ksCurDomain ba = ksCurDomain s''; ksDomainTime ba = ksDomainTime s''; pspace_relation (kheap t) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); ctes_of s'' = modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c')); gsUserPages s'' = gsUserPages b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; ctes_of s''a = modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))); ksInterruptState s''a = ksInterruptState s''; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx s''; ksDomSchedule s''a = ksDomSchedule s''; ksCurDomain s''a = ksCurDomain s''; ksDomainTime s''a = ksDomainTime s''; ctes_of s''b = modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest))); ksInterruptState s''b = ksInterruptState s''; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''; ksDomSchedule s''b = ksDomSchedule s''; ksCurDomain s''b = ksCurDomain s''; ksDomainTime s''b = ksDomainTime s''; ctes_of ba = modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))); ksInterruptState ba = ksInterruptState s''; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''; ksDomSchedule ba = ksDomSchedule s''; ksCurDomain ba = ksCurDomain s''; ksDomainTime ba = ksDomainTime s''; pspace_relation (kheap t) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); ctes_of s'' = modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c')); gsUserPages s'' = gsUserPages b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; ctes_of s''a = modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))); ksInterruptState s''a = ksInterruptState s''; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx s''; ksDomSchedule s''a = ksDomSchedule s''; ksCurDomain s''a = ksCurDomain s''; ksDomainTime s''a = ksDomainTime s''; ctes_of s''b = modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest))); ksInterruptState s''b = ksInterruptState s''; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''; ksDomSchedule s''b = ksDomSchedule s''; ksCurDomain s''b = ksCurDomain s''; ksDomainTime s''b = ksDomainTime s''; ctes_of ba = modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))); ksInterruptState ba = ksInterruptState s''; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''; ksDomSchedule ba = ksDomSchedule s''; ksCurDomain ba = ksCurDomain s''; ksDomainTime ba = ksDomainTime s''; pspace_relation (kheap t) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); work_units_completed a = ksWorkUnitsCompleted b; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; work_units_completed t = ksWorkUnitsCompleted b; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); ctes_of s'' = modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c')); gsUserPages s'' = gsUserPages b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; ctes_of s''a = modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))); ksInterruptState s''a = ksInterruptState s''; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx s''; ksDomSchedule s''a = ksDomSchedule s''; ksCurDomain s''a = ksCurDomain s''; ksDomainTime s''a = ksDomainTime s''; ctes_of s''b = modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest))); ksInterruptState s''b = ksInterruptState s''; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''; ksDomSchedule s''b = ksDomSchedule s''; ksCurDomain s''b = ksCurDomain s''; ksDomainTime s''b = ksDomainTime s''; ctes_of ba = modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))); ksInterruptState ba = ksInterruptState s''; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''; ksDomSchedule ba = ksDomSchedule s''; ksCurDomain ba = ksCurDomain s''; ksDomainTime ba = ksDomainTime s''; pspace_relation (kheap t) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); ctes_of s'' = modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c')); gsUserPages s'' = gsUserPages b; ksArchState s'' = ksArchState b; pspace_aligned' s''; pspace_distinct' s''; ctes_of s''a = modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))); ksInterruptState s''a = ksInterruptState s''; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx s''; ksDomSchedule s''a = ksDomSchedule s''; ksCurDomain s''a = ksCurDomain s''; ksDomainTime s''a = ksDomainTime s''; ctes_of s''b = modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest))); ksInterruptState s''b = ksInterruptState s''; ksArchState s''b = ksArchState b; gsUserPages s''b = gsUserPages b; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''; ksDomSchedule s''b = ksDomSchedule s''; ksCurDomain s''b = ksCurDomain s''; ksDomainTime s''b = ksDomainTime s''; ctes_of ba = modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))); ksInterruptState ba = ksInterruptState s''; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''; ksDomSchedule ba = ksDomSchedule s''; ksCurDomain ba = ksCurDomain s''; ksDomainTime ba = ksDomainTime s''; pspace_relation (kheap t) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); ctes_of s'' = modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c')); gsUserPages s'' = gsUserPages b; pspace_aligned' s''; pspace_distinct' s''; ctes_of s''a = modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))); ksInterruptState s''a = ksInterruptState s''; gsUserPages s''a = gsUserPages b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx s''; ksDomSchedule s''a = ksDomSchedule s''; ksCurDomain s''a = ksCurDomain s''; ksDomainTime s''a = ksDomainTime s''; ctes_of s''b = modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest))); ksInterruptState s''b = ksInterruptState s''; gsUserPages s''b = gsUserPages b; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''; ksDomSchedule s''b = ksDomSchedule s''; ksCurDomain s''b = ksCurDomain s''; ksDomainTime s''b = ksDomainTime s''; ctes_of ba = modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))); ksInterruptState ba = ksInterruptState s''; gsUserPages ba = gsUserPages b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''; ksDomSchedule ba = ksDomSchedule s''; ksCurDomain ba = ksCurDomain s''; ksDomainTime ba = ksDomainTime s''; pspace_relation (kheap t) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); ctes_of s'' = modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c')); pspace_aligned' s''; pspace_distinct' s''; ctes_of s''a = modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))); ksInterruptState s''a = ksInterruptState s''; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx s''; ksDomSchedule s''a = ksDomSchedule s''; ksCurDomain s''a = ksCurDomain s''; ksDomainTime s''a = ksDomainTime s''; ctes_of s''b = modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest))); ksInterruptState s''b = ksInterruptState s''; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''; ksDomSchedule s''b = ksDomSchedule s''; ksCurDomain s''b = ksCurDomain s''; ksDomainTime s''b = ksDomainTime s''; ctes_of ba = modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))); ksInterruptState ba = ksInterruptState s''; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''; ksDomSchedule ba = ksDomSchedule s''; ksCurDomain ba = ksCurDomain s''; ksDomainTime ba = ksDomainTime s''; pspace_relation (kheap t) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); ctes_of s'' = modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c')); pspace_aligned' s''; pspace_distinct' s''; ctes_of s''a = modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))); ksInterruptState s''a = ksInterruptState s''; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx s''; ksDomSchedule s''a = ksDomSchedule s''; ksDomainTime s''a = ksDomainTime s''; ctes_of s''b = modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest))); ksInterruptState s''b = ksInterruptState s''; pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''; ksDomSchedule s''b = ksDomSchedule s''; ksDomainTime s''b = ksDomainTime s''; ctes_of ba = modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))); ksInterruptState ba = ksInterruptState s''; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''; ksDomSchedule ba = ksDomSchedule s''; ksDomainTime ba = ksDomainTime s''; pspace_relation (kheap t) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); ctes_of s'' = modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c')); pspace_aligned' s''; pspace_distinct' s''; ctes_of s''a = modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))); pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx s''; ksDomSchedule s''a = ksDomSchedule s''; ksDomainTime s''a = ksDomainTime s''; ctes_of s''b = modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest))); pspace_aligned' s''b; pspace_distinct' s''b; ksDomScheduleIdx s''b = ksDomScheduleIdx s''; ksDomSchedule s''b = ksDomSchedule s''; ksDomainTime s''b = ksDomainTime s''; ctes_of ba = modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''; ksDomSchedule ba = ksDomSchedule s''; ksDomainTime ba = ksDomainTime s''; pspace_relation (kheap t) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); ctes_of s'' = modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c')); pspace_aligned' s''; pspace_distinct' s''; ctes_of s''a = modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))); pspace_aligned' s''a; pspace_distinct' s''a; ksDomSchedule s''a = ksDomSchedule s''; ksDomainTime s''a = ksDomainTime s''; ctes_of s''b = modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest))); pspace_aligned' s''b; pspace_distinct' s''b; ksDomSchedule s''b = ksDomSchedule s''; ksDomainTime s''b = ksDomainTime s''; ctes_of ba = modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))); pspace_aligned' ba; pspace_distinct' ba; ksDomSchedule ba = ksDomSchedule s''; ksDomainTime ba = ksDomainTime s''; pspace_relation (kheap t) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); ctes_of s'' = modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c')); pspace_aligned' s''; pspace_distinct' s''; ctes_of s''a = modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))); pspace_aligned' s''a; pspace_distinct' s''a; ksDomSchedule s''a = ksDomSchedule s''; ctes_of s''b = modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest))); pspace_aligned' s''b; pspace_distinct' s''b; ksDomSchedule s''b = ksDomSchedule s''; ctes_of ba = modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))); pspace_aligned' ba; pspace_distinct' ba; ksDomSchedule ba = ksDomSchedule s''; pspace_relation (kheap t) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); ctes_of s'' = modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c')); pspace_aligned' s''; pspace_distinct' s''; ctes_of s''a = modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))); pspace_aligned' s''a; pspace_distinct' s''a; ctes_of s''b = modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest))); pspace_aligned' s''b; pspace_distinct' s''b; ctes_of ba = modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))); pspace_aligned' ba; pspace_distinct' ba; pspace_relation (kheap t) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; pspace_relation (kheap t) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''a); ekheap_relation (ekheap a) (ksPSpace s''a); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; pspace_relation (kheap t) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''a); pspace_relation (kheap t) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''); (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b)
 2. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 4. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 8. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 10. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
A total of 12 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap_ (cteCap srcCTE_); cteCap rv'_ = capability.NullCap; mdbPrev (cteMDBNode rv'_) = nullPointer; mdbNext (cteMDBNode rv'_) = nullPointer; ghost_relation (kheap a_) (gsUserPages b_) (gsCNodes b_); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a_) (cdt a_) (ctes_of b_); cdt_list_relation (cdt_list a_) (cdt a_) (ctes_of b_); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; domain_list a_ = ksDomSchedule b_; valid_objs a_; pspace_distinct a_; pspace_aligned a_; valid_mdb a_; valid_list a_; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a_; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a_; cte_wp_at (safe_parent_for (cdt a_) src c) src a_; cte_wp_at ((=) (masked_as_full src_cap_ c)) src a_; pspace_distinct' b_; pspace_aligned' b_; valid_dlist (ctes_of b_); no_0 (ctes_of b_); mdb_chain_0 (ctes_of b_); valid_badges (ctes_of b_); caps_contained' (ctes_of b_); mdb_chunked (ctes_of b_); untyped_mdb' (ctes_of b_); untyped_inc' (ctes_of b_); valid_nullcaps (ctes_of b_); ut_revocable' (ctes_of b_); class_links (ctes_of b_); distinct_zombies (ctes_of b_); irq_control (ctes_of b_); reply_masters_rvk_fb (ctes_of b_); valid_cap' c' b_; is_simple_cap' c'; cte_wp_at' ((=) rv'_) (cte_map dest) b_; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE_) c') (cteMDBNode srcCTE_))) (cte_map src) b_; safe_parent_for' (ctes_of b_) (cte_map src) c'; ((), t_) \<in> fst (set_cap c dest a_); cdt t_ = cdt a_; cdt_list t_ = cdt_list a_; ekheap t_ = ekheap a_; is_original_cap t_ = is_original_cap a_; (arch_state t_, ksArchState b_) \<in> arch_state_relation; domain_list t_ = ksDomSchedule s''_; mdb_insert_abs (cdt a_) src dest; no_mloop (cdt a_); pspace_aligned' s''_; pspace_distinct' s''_; pspace_aligned' s''a_; pspace_distinct' s''a_; pspace_aligned' s''b_; pspace_distinct' s''b_; pspace_aligned' ba_; pspace_distinct' ba_\<rbrakk> \<Longrightarrow> ghost_relation (kheap t_) (gsUserPages b_) (gsCNodes b_) proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; cte_wp_at' ((=) rv') (cte_map dest) b; cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) b; safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 2. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba\<rbrakk> \<Longrightarrow> cte_map dest \<noteq> 0
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 4. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 8. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 10. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba\<rbrakk> \<Longrightarrow> cte_map dest \<noteq> 0
 2. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 4. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 8. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 10. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 2. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0\<rbrakk> \<Longrightarrow> cte_map src \<noteq> 0
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 4. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 8. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 10. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0\<rbrakk> \<Longrightarrow> cte_map src \<noteq> 0
 2. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 4. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 8. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 10. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) = True\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 2. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0\<rbrakk> \<Longrightarrow> should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) = True
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 4. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 8. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 10. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0\<rbrakk> \<Longrightarrow> should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) = True
 2. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) = True\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 4. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 8. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 10. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0\<rbrakk> \<Longrightarrow> should_be_parent_of (masked_as_full src_cap (?c817 src_cap srcCTE rv' a b ba s'' s''a s''b t)) (is_original_cap a src) c (revokable src_cap c) = True
 2. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) = True\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 4. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 8. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 10. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
A total of 12 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0\<rbrakk> \<Longrightarrow> safe_parent_for (?m820 src_cap srcCTE rv' a b ba s'' s''a s''b t) src c (masked_as_full src_cap (?c821 src_cap src_cap srcCTE rv' a b ba s'' s''a s''b t (?srcCTE820 src_cap srcCTE rv' a b ba s'' s''a s''b t) (?rv'820 src_cap srcCTE rv' a b ba s'' s''a s''b t) a (?b820 src_cap srcCTE rv' a b ba s'' s''a s''b t) (?ba820 src_cap srcCTE rv' a b ba s'' s''a s''b t) (?s''820 src_cap srcCTE rv' a b ba s'' s''a s''b t) (?s''a820 src_cap srcCTE rv' a b ba s'' s''a s''b t) (?s''b820 src_cap srcCTE rv' a b ba s'' s''a s''b t) (?t820 src_cap srcCTE rv' a b ba s'' s''a s''b t)))
 2. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0\<rbrakk> \<Longrightarrow> caps_of_state a src = Some (masked_as_full src_cap (?c821 src_cap src_cap srcCTE rv' a b ba s'' s''a s''b t (?srcCTE820 src_cap srcCTE rv' a b ba s'' s''a s''b t) (?rv'820 src_cap srcCTE rv' a b ba s'' s''a s''b t) a (?b820 src_cap srcCTE rv' a b ba s'' s''a s''b t) (?ba820 src_cap srcCTE rv' a b ba s'' s''a s''b t) (?s''820 src_cap srcCTE rv' a b ba s'' s''a s''b t) (?s''a820 src_cap srcCTE rv' a b ba s'' s''a s''b t) (?s''b820 src_cap srcCTE rv' a b ba s'' s''a s''b t) (?t820 src_cap srcCTE rv' a b ba s'' s''a s''b t)))
 3. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0\<rbrakk> \<Longrightarrow> valid_mdb a
 4. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0\<rbrakk> \<Longrightarrow> True = True
 5. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) = True\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 6. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 7. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 8. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 9. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 10. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
A total of 15 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) = True\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) = True\<rbrakk> \<Longrightarrow> (cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))))) \<and> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) = True\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))))
 2. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) = True\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 4. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 8. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 10. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) = True\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE))))))
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(dest := revokable src_cap c)) (null_filter (caps_of_state t)) ((ctes_of b)(cte_map dest \<mapsto> cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv')))
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; ((ctes_of b)(cte_map dest \<mapsto> cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv'))) (cte_map (aa, bb)) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> ((is_original_cap a)(dest := revokable src_cap c)) (aa, bb) = mdbRevocable node
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv')) else ctes_of b (cte_map (aa, bb))) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> ((aa, bb) = dest \<longrightarrow> revokable src_cap c = mdbRevocable node) \<and> ((aa, bb) \<noteq> dest \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node)
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 12 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv')) else ctes_of b (cte_map (aa, bb))) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (aa, bb) = dest \<longrightarrow> revokable src_cap c = mdbRevocable node
 2. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv')) else ctes_of b (cte_map (aa, bb))) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (aa, bb) \<noteq> dest \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 4. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 8. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 10. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map (aa, bb); cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map (aa, bb)) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map (aa, bb) \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv') = CTE cap node; dest = (aa, bb)\<rbrakk> \<Longrightarrow> revokable src_cap c = mdbRevocable node
 2. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv')) else ctes_of b (cte_map (aa, bb))) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (aa, bb) \<noteq> dest \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 4. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 8. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 10. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
A total of 13 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map (aa, bb); cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map (aa, bb)) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map (aa, bb) \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv') = CTE cap node; dest = (aa, bb); mdbRevocable node = revokable' (cteCap srcCTE) c'\<rbrakk> \<Longrightarrow> revokable src_cap c = mdbRevocable node
 2. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map (aa, bb); cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map (aa, bb)) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map (aa, bb) \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv') = CTE cap node; dest = (aa, bb)\<rbrakk> \<Longrightarrow> mdbRevocable node = revokable' (cteCap srcCTE) c'
 3. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv')) else ctes_of b (cte_map (aa, bb))) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (aa, bb) \<noteq> dest \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 4. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 5. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 6. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 7. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 8. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 9. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 10. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map (aa, bb); cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map (aa, bb)) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map (aa, bb) \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv') = CTE cap node; dest = (aa, bb)\<rbrakk> \<Longrightarrow> mdbRevocable node = revokable' (cteCap srcCTE) c'
 2. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map (aa, bb); cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map (aa, bb)) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map (aa, bb) \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv') = CTE cap node; dest = (aa, bb); mdbRevocable node = revokable' (cteCap srcCTE) c'\<rbrakk> \<Longrightarrow> revokable src_cap c = mdbRevocable node
 3. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv')) else ctes_of b (cte_map (aa, bb))) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (aa, bb) \<noteq> dest \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 4. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 5. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 6. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 7. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 8. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 9. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 10. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node x1 x2. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map (aa, bb); cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map (aa, bb)) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map (aa, bb) \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv') = CTE cap node; dest = (aa, bb); rv' = CTE x1 x2\<rbrakk> \<Longrightarrow> mdbRevocable node = revokable' (cteCap srcCTE) c'
 2. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map (aa, bb); cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map (aa, bb)) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map (aa, bb) \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv') = CTE cap node; dest = (aa, bb); mdbRevocable node = revokable' (cteCap srcCTE) c'\<rbrakk> \<Longrightarrow> revokable src_cap c = mdbRevocable node
 3. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv')) else ctes_of b (cte_map (aa, bb))) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (aa, bb) \<noteq> dest \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 4. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 5. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 6. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 7. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 8. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 9. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 10. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map (aa, bb); cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map (aa, bb)) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map (aa, bb) \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv') = CTE cap node; dest = (aa, bb); mdbRevocable node = revokable' (cteCap srcCTE) c'\<rbrakk> \<Longrightarrow> revokable src_cap c = mdbRevocable node
 2. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv')) else ctes_of b (cte_map (aa, bb))) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (aa, bb) \<noteq> dest \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 4. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 8. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 10. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map (aa, bb); cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map (aa, bb)) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map (aa, bb) \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv') = CTE cap node; dest = (aa, bb); mdbRevocable node = revokable' (cteCap srcCTE) c'\<rbrakk> \<Longrightarrow> revokable src_cap c = revokable' (cteCap srcCTE) c'
 2. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv')) else ctes_of b (cte_map (aa, bb))) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (aa, bb) \<noteq> dest \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 4. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 8. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 10. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
A total of 13 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map (aa, bb); cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map (aa, bb)) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map (aa, bb) \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv') = CTE cap node; dest = (aa, bb); mdbRevocable node = revokable' (cteCap srcCTE) c'\<rbrakk> \<Longrightarrow> global.sameRegionAs (cteCap srcCTE) c'
 2. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map (aa, bb); cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map (aa, bb)) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map (aa, bb) \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv') = CTE cap node; dest = (aa, bb); mdbRevocable node = revokable' (cteCap srcCTE) c'\<rbrakk> \<Longrightarrow> is_untyped_cap src_cap \<longrightarrow> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c
 3. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv')) else ctes_of b (cte_map (aa, bb))) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (aa, bb) \<noteq> dest \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 4. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 5. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 6. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 7. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 8. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 9. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 10. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
A total of 14 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map (aa, bb); cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map (aa, bb)) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map (aa, bb) \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv') = CTE cap node; dest = (aa, bb); mdbRevocable node = revokable' (cteCap srcCTE) c'\<rbrakk> \<Longrightarrow> cap_relation (?c872 src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node) (cteCap srcCTE)
 2. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map (aa, bb); cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map (aa, bb)) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map (aa, bb) \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv') = CTE cap node; dest = (aa, bb); mdbRevocable node = revokable' (cteCap srcCTE) c'\<rbrakk> \<Longrightarrow> cap_relation (?c'872 src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node) c'
 3. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map (aa, bb); cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map (aa, bb)) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map (aa, bb) \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv') = CTE cap node; dest = (aa, bb); mdbRevocable node = revokable' (cteCap srcCTE) c'\<rbrakk> \<Longrightarrow> same_region_as (?c872 src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node) (?c'872 src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node)
 4. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map (aa, bb); cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map (aa, bb)) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map (aa, bb) \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv') = CTE cap node; dest = (aa, bb); mdbRevocable node = revokable' (cteCap srcCTE) c'\<rbrakk> \<Longrightarrow> is_untyped_cap src_cap \<longrightarrow> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c
 5. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv')) else ctes_of b (cte_map (aa, bb))) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (aa, bb) \<noteq> dest \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 6. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 7. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 8. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 9. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 10. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map (aa, bb); cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map (aa, bb)) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map (aa, bb) \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv') = CTE cap node; dest = (aa, bb); mdbRevocable node = revokable' (cteCap srcCTE) c'\<rbrakk> \<Longrightarrow> same_region_as (?c872 src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node) (?c'872 src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node)
 2. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map (aa, bb); cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map (aa, bb)) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map (aa, bb) \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv') = CTE cap node; dest = (aa, bb); mdbRevocable node = revokable' (cteCap srcCTE) c'\<rbrakk> \<Longrightarrow> cap_relation (?c872 src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node) (cteCap srcCTE)
 3. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map (aa, bb); cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map (aa, bb)) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map (aa, bb) \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv') = CTE cap node; dest = (aa, bb); mdbRevocable node = revokable' (cteCap srcCTE) c'\<rbrakk> \<Longrightarrow> cap_relation (?c'872 src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node) c'
 4. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map (aa, bb); cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map (aa, bb)) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map (aa, bb) \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv') = CTE cap node; dest = (aa, bb); mdbRevocable node = revokable' (cteCap srcCTE) c'\<rbrakk> \<Longrightarrow> is_untyped_cap src_cap \<longrightarrow> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c
 5. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv')) else ctes_of b (cte_map (aa, bb))) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (aa, bb) \<noteq> dest \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 6. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 7. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 8. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 9. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 10. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map (aa, bb); cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map (aa, bb)) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map (aa, bb) \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv') = CTE cap node; dest = (aa, bb); mdbRevocable node = revokable' (cteCap srcCTE) c'\<rbrakk> \<Longrightarrow> safe_parent_for (?m874 src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node) (?p874 src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node) (?c'872 src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node) (?c872 src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node)
 2. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map (aa, bb); cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map (aa, bb)) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map (aa, bb) \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv') = CTE cap node; dest = (aa, bb); mdbRevocable node = revokable' (cteCap srcCTE) c'\<rbrakk> \<Longrightarrow> cap_relation (?c872 src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node) (cteCap srcCTE)
 3. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map (aa, bb); cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map (aa, bb)) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map (aa, bb) \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv') = CTE cap node; dest = (aa, bb); mdbRevocable node = revokable' (cteCap srcCTE) c'\<rbrakk> \<Longrightarrow> cap_relation (?c'872 src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node) c'
 4. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map (aa, bb); cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map (aa, bb)) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map (aa, bb) \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv') = CTE cap node; dest = (aa, bb); mdbRevocable node = revokable' (cteCap srcCTE) c'\<rbrakk> \<Longrightarrow> is_untyped_cap src_cap \<longrightarrow> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c
 5. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv')) else ctes_of b (cte_map (aa, bb))) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (aa, bb) \<noteq> dest \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 6. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 7. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 8. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 9. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 10. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map (aa, bb); cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map (aa, bb)) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map (aa, bb) \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv') = CTE cap node; dest = (aa, bb); mdbRevocable node = revokable' (cteCap srcCTE) c'\<rbrakk> \<Longrightarrow> cap_relation src_cap (cteCap srcCTE)
 2. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map (aa, bb); cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map (aa, bb)) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map (aa, bb) \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv') = CTE cap node; dest = (aa, bb); mdbRevocable node = revokable' (cteCap srcCTE) c'\<rbrakk> \<Longrightarrow> cap_relation c c'
 3. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map (aa, bb); cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map (aa, bb)) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map (aa, bb) \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv') = CTE cap node; dest = (aa, bb); mdbRevocable node = revokable' (cteCap srcCTE) c'\<rbrakk> \<Longrightarrow> is_untyped_cap src_cap \<longrightarrow> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c
 4. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv')) else ctes_of b (cte_map (aa, bb))) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (aa, bb) \<noteq> dest \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 5. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 6. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 7. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 8. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 9. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 10. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map (aa, bb); cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map (aa, bb)) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map (aa, bb) \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv') = CTE cap node; dest = (aa, bb); mdbRevocable node = revokable' (cteCap srcCTE) c'\<rbrakk> \<Longrightarrow> cap_relation c c'
 2. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map (aa, bb); cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map (aa, bb)) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map (aa, bb) \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv') = CTE cap node; dest = (aa, bb); mdbRevocable node = revokable' (cteCap srcCTE) c'\<rbrakk> \<Longrightarrow> is_untyped_cap src_cap \<longrightarrow> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c
 3. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv')) else ctes_of b (cte_map (aa, bb))) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (aa, bb) \<noteq> dest \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 4. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 5. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 6. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 7. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 8. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 9. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 10. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map (aa, bb); cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map (aa, bb)) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map (aa, bb) \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv') = CTE cap node; dest = (aa, bb); mdbRevocable node = revokable' (cteCap srcCTE) c'\<rbrakk> \<Longrightarrow> is_untyped_cap src_cap \<longrightarrow> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c
 2. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv')) else ctes_of b (cte_map (aa, bb))) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (aa, bb) \<noteq> dest \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 4. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 8. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 10. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv')) else ctes_of b (cte_map (aa, bb))) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (aa, bb) \<noteq> dest \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv')) else ctes_of b (cte_map (aa, bb))) = Some (CTE cap node); (aa, bb) \<noteq> dest\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node x1 x2. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv')) else ctes_of b (cte_map (aa, bb))) = Some (CTE cap node); (aa, bb) \<noteq> dest; srcCTE = CTE x1 x2\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t aa bb y cap node x1 x2 x1a x2a. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))) (cteCap_update (\<lambda>y. c') rv')) else ctes_of b (cte_map (aa, bb))) = Some (CTE cap node); (aa, bb) \<noteq> dest; srcCTE = CTE x1 x2; rv' = CTE x1a x2a\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t aa bb y cap node x1 x2 x2a. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap x1; mdbPrev x2a = 0; mdbNext x2a = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap x2a); ctes_of b (cte_map src) = Some (CTE (maskedAsFull x1 c') x2); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (CTE c' (mdbFirstBadged_update (\<lambda>_. revokable' x1 c') (mdbRevocable_update (\<lambda>_. revokable' x1 c') (mdbPrev_update (\<lambda>_. cte_map src) x2)))) else ctes_of b (cte_map (aa, bb))) = Some (CTE cap node); (aa, bb) \<noteq> dest\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 12 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t aa bb y cap node x1 x2 x2a. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap x1; mdbPrev x2a = 0; mdbNext x2a = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap x2a); ctes_of b (cte_map src) = Some (CTE (maskedAsFull x1 c') x2); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (CTE c' (mdbFirstBadged_update (\<lambda>_. revokable' x1 c') (mdbRevocable_update (\<lambda>_. revokable' x1 c') (mdbPrev_update (\<lambda>_. cte_map src) x2)))) else ctes_of b (cte_map (aa, bb))) = Some (CTE cap node); (aa, bb) \<noteq> dest; \<exists>cap' node'. ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 2. \<And>src_cap a b ba s'' s''a s''b t aa bb y cap node x1 x2 x2a. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap x1; mdbPrev x2a = 0; mdbNext x2a = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap x2a); ctes_of b (cte_map src) = Some (CTE (maskedAsFull x1 c') x2); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (CTE c' (mdbFirstBadged_update (\<lambda>_. revokable' x1 c') (mdbRevocable_update (\<lambda>_. revokable' x1 c') (mdbPrev_update (\<lambda>_. cte_map src) x2)))) else ctes_of b (cte_map (aa, bb))) = Some (CTE cap node); (aa, bb) \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap' node'. ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node')
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 4. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 8. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 10. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t aa bb y cap node x1 x2 x2a. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap x1; mdbPrev x2a = 0; mdbNext x2a = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap x2a); ctes_of b (cte_map src) = Some (CTE (maskedAsFull x1 c') x2); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (CTE c' (mdbFirstBadged_update (\<lambda>_. revokable' x1 c') (mdbRevocable_update (\<lambda>_. revokable' x1 c') (mdbPrev_update (\<lambda>_. cte_map src) x2)))) else ctes_of b (cte_map (aa, bb))) = Some (CTE cap node); (aa, bb) \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap' node'. ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node')
 2. \<And>src_cap a b ba s'' s''a s''b t aa bb y cap node x1 x2 x2a. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap x1; mdbPrev x2a = 0; mdbNext x2a = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap x2a); ctes_of b (cte_map src) = Some (CTE (maskedAsFull x1 c') x2); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (CTE c' (mdbFirstBadged_update (\<lambda>_. revokable' x1 c') (mdbRevocable_update (\<lambda>_. revokable' x1 c') (mdbPrev_update (\<lambda>_. cte_map src) x2)))) else ctes_of b (cte_map (aa, bb))) = Some (CTE cap node); (aa, bb) \<noteq> dest; \<exists>cap' node'. ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 4. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 8. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 10. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
A total of 13 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap_ x1_; mdbPrev x2a_ = 0; mdbNext x2a_ = 0; ghost_relation (kheap a_) (gsUserPages b_) (gsCNodes b_); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a_) (cdt a_) (ctes_of b_); cdt_list_relation (cdt_list a_) (cdt a_) (ctes_of b_); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a_) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b_ (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a_ (aa, ba) = mdbRevocable node); (arch_state a_, ksArchState b_) \<in> arch_state_relation; domain_list a_ = ksDomSchedule b_; valid_objs a_; pspace_distinct a_; pspace_aligned a_; valid_mdb a_; valid_list a_; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a_; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a_; cte_wp_at (safe_parent_for (cdt a_) src c) src a_; cte_wp_at ((=) (masked_as_full src_cap_ c)) src a_; pspace_distinct' b_; pspace_aligned' b_; valid_dlist (ctes_of b_); no_0 (ctes_of b_); mdb_chain_0 (ctes_of b_); valid_badges (ctes_of b_); caps_contained' (ctes_of b_); mdb_chunked (ctes_of b_); untyped_mdb' (ctes_of b_); untyped_inc' (ctes_of b_); valid_nullcaps (ctes_of b_); ut_revocable' (ctes_of b_); class_links (ctes_of b_); distinct_zombies (ctes_of b_); irq_control (ctes_of b_); reply_masters_rvk_fb (ctes_of b_); valid_cap' c' b_; is_simple_cap' c'; ctes_of b_ (cte_map dest) = Some (CTE capability.NullCap x2a_); ctes_of b_ (cte_map src) = Some (CTE (maskedAsFull x1_ c') x2_); safe_parent_for' (ctes_of b_) (cte_map src) c'; ((), t_) \<in> fst (set_cap c dest a_); cdt t_ = cdt a_; cdt_list t_ = cdt_list a_; ekheap t_ = ekheap a_; is_original_cap t_ = is_original_cap a_; (arch_state t_, ksArchState b_) \<in> arch_state_relation; domain_list t_ = ksDomSchedule s''_; mdb_insert_abs (cdt a_) src dest; no_mloop (cdt a_); pspace_aligned' s''_; pspace_distinct' s''_; pspace_aligned' s''a_; pspace_distinct' s''a_; pspace_aligned' s''b_; pspace_distinct' s''b_; pspace_aligned' ba_; pspace_distinct' ba_; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap_ (is_original_cap a_ src) c (revokable src_cap_ c); null_filter (caps_of_state t_) (aa_, bb_) = Some y_; (if cte_map (aa_, bb_) = cte_map dest then Some (CTE c' (mdbFirstBadged_update (\<lambda>_. revokable' x1_ c') (mdbRevocable_update (\<lambda>_. revokable' x1_ c') (mdbPrev_update (\<lambda>_. cte_map src) x2_)))) else ctes_of b_ (cte_map (aa_, bb_))) = Some (CTE cap_ node_); (aa_, bb_) \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cap' node'. ctes_of b_ (cte_map (aa_, bb_)) = Some (CTE cap' node') proof (prove)
goal (12 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t aa bb y cap node x1 x2 x2a. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap x1; mdbPrev x2a = 0; mdbNext x2a = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap x2a); ctes_of b (cte_map src) = Some (CTE (maskedAsFull x1 c') x2); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (CTE c' (mdbFirstBadged_update (\<lambda>_. revokable' x1 c') (mdbRevocable_update (\<lambda>_. revokable' x1 c') (mdbPrev_update (\<lambda>_. cte_map src) x2)))) else ctes_of b (cte_map (aa, bb))) = Some (CTE cap node); (aa, bb) \<noteq> dest; \<exists>cap' node'. ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t aa bb y cap node x1 x2 x2a cap' node'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap x1; mdbPrev x2a = 0; mdbNext x2a = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap x2a); ctes_of b (cte_map src) = Some (CTE (maskedAsFull x1 c') x2); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (CTE c' (mdbFirstBadged_update (\<lambda>_. revokable' x1 c') (mdbRevocable_update (\<lambda>_. revokable' x1 c') (mdbPrev_update (\<lambda>_. cte_map src) x2)))) else Some (CTE cap' node')) = Some (CTE cap node); (aa, bb) \<noteq> dest; ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t aa bb y cap node x1 x2 x2a cap' node'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap x1; mdbPrev x2a = 0; mdbNext x2a = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap x2a); ctes_of b (cte_map src) = Some (CTE (maskedAsFull x1 c') x2); safe_parent_for' (ctes_of b) (cte_map src) c'; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (CTE c' (mdbFirstBadged_update (\<lambda>_. revokable' x1 c') (mdbRevocable_update (\<lambda>_. revokable' x1 c') (mdbPrev_update (\<lambda>_. cte_map src) x2)))) else Some (CTE cap' node')) = Some (CTE cap node); (aa, bb) \<noteq> dest; ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node'); caps_of_state t = (caps_of_state a)(dest \<mapsto> c)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 12 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t aa bb y cap node x1 x2 x2a cap' node'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap x1; mdbPrev x2a = 0; mdbNext x2a = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap x2a); ctes_of b (cte_map src) = Some (CTE (maskedAsFull x1 c') x2); safe_parent_for' (ctes_of b) (cte_map src) c'; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (CTE c' (mdbFirstBadged_update (\<lambda>_. revokable' x1 c') (mdbRevocable_update (\<lambda>_. revokable' x1 c') (mdbPrev_update (\<lambda>_. cte_map src) x2)))) else Some (CTE cap' node')) = Some (CTE cap node); (aa, bb) \<noteq> dest; ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node'); caps_of_state t = (caps_of_state a)(dest \<mapsto> c); null_filter (caps_of_state a) (aa, bb) \<noteq> None\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 2. \<And>src_cap a b ba s'' s''a s''b t aa bb y cap node x1 x2 x2a cap' node'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap x1; mdbPrev x2a = 0; mdbNext x2a = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap x2a); ctes_of b (cte_map src) = Some (CTE (maskedAsFull x1 c') x2); safe_parent_for' (ctes_of b) (cte_map src) c'; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (CTE c' (mdbFirstBadged_update (\<lambda>_. revokable' x1 c') (mdbRevocable_update (\<lambda>_. revokable' x1 c') (mdbPrev_update (\<lambda>_. cte_map src) x2)))) else Some (CTE cap' node')) = Some (CTE cap node); (aa, bb) \<noteq> dest; ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node'); caps_of_state t = (caps_of_state a)(dest \<mapsto> c)\<rbrakk> \<Longrightarrow> null_filter (caps_of_state a) (aa, bb) \<noteq> None
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 4. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 8. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 10. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t aa bb y cap node x1 x2 x2a cap' node'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap x1; mdbPrev x2a = 0; mdbNext x2a = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap x2a); ctes_of b (cte_map src) = Some (CTE (maskedAsFull x1 c') x2); safe_parent_for' (ctes_of b) (cte_map src) c'; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (CTE c' (mdbFirstBadged_update (\<lambda>_. revokable' x1 c') (mdbRevocable_update (\<lambda>_. revokable' x1 c') (mdbPrev_update (\<lambda>_. cte_map src) x2)))) else Some (CTE cap' node')) = Some (CTE cap node); (aa, bb) \<noteq> dest; ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node'); caps_of_state t = (caps_of_state a)(dest \<mapsto> c)\<rbrakk> \<Longrightarrow> null_filter (caps_of_state a) (aa, bb) \<noteq> None
 2. \<And>src_cap a b ba s'' s''a s''b t aa bb y cap node x1 x2 x2a cap' node'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap x1; mdbPrev x2a = 0; mdbNext x2a = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap x2a); ctes_of b (cte_map src) = Some (CTE (maskedAsFull x1 c') x2); safe_parent_for' (ctes_of b) (cte_map src) c'; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (CTE c' (mdbFirstBadged_update (\<lambda>_. revokable' x1 c') (mdbRevocable_update (\<lambda>_. revokable' x1 c') (mdbPrev_update (\<lambda>_. cte_map src) x2)))) else Some (CTE cap' node')) = Some (CTE cap node); (aa, bb) \<noteq> dest; ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node'); caps_of_state t = (caps_of_state a)(dest \<mapsto> c); null_filter (caps_of_state a) (aa, bb) \<noteq> None\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 4. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 8. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 10. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
A total of 13 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap_ x1_; mdbPrev x2a_ = 0; mdbNext x2a_ = 0; ghost_relation (kheap a_) (gsUserPages b_) (gsCNodes b_); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a_) (cdt a_) (ctes_of b_); cdt_list_relation (cdt_list a_) (cdt a_) (ctes_of b_); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a_) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b_ (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a_ (aa, ba) = mdbRevocable node); (arch_state a_, ksArchState b_) \<in> arch_state_relation; domain_list a_ = ksDomSchedule b_; valid_objs a_; pspace_distinct a_; pspace_aligned a_; valid_mdb a_; valid_list a_; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a_; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a_; cte_wp_at (safe_parent_for (cdt a_) src c) src a_; cte_wp_at ((=) (masked_as_full src_cap_ c)) src a_; pspace_distinct' b_; pspace_aligned' b_; valid_dlist (ctes_of b_); no_0 (ctes_of b_); mdb_chain_0 (ctes_of b_); valid_badges (ctes_of b_); caps_contained' (ctes_of b_); mdb_chunked (ctes_of b_); untyped_mdb' (ctes_of b_); untyped_inc' (ctes_of b_); valid_nullcaps (ctes_of b_); ut_revocable' (ctes_of b_); class_links (ctes_of b_); distinct_zombies (ctes_of b_); irq_control (ctes_of b_); reply_masters_rvk_fb (ctes_of b_); valid_cap' c' b_; is_simple_cap' c'; ctes_of b_ (cte_map dest) = Some (CTE capability.NullCap x2a_); ctes_of b_ (cte_map src) = Some (CTE (maskedAsFull x1_ c') x2_); safe_parent_for' (ctes_of b_) (cte_map src) c'; cdt t_ = cdt a_; cdt_list t_ = cdt_list a_; ekheap t_ = ekheap a_; is_original_cap t_ = is_original_cap a_; (arch_state t_, ksArchState b_) \<in> arch_state_relation; domain_list t_ = ksDomSchedule s''_; mdb_insert_abs (cdt a_) src dest; no_mloop (cdt a_); pspace_aligned' s''_; pspace_distinct' s''_; pspace_aligned' s''a_; pspace_distinct' s''a_; pspace_aligned' s''b_; pspace_distinct' s''b_; pspace_aligned' ba_; pspace_distinct' ba_; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap_ (is_original_cap a_ src) c (revokable src_cap_ c); null_filter (caps_of_state t_) (aa_, bb_) = Some y_; (if cte_map (aa_, bb_) = cte_map dest then Some (CTE c' (mdbFirstBadged_update (\<lambda>_. revokable' x1_ c') (mdbRevocable_update (\<lambda>_. revokable' x1_ c') (mdbPrev_update (\<lambda>_. cte_map src) x2_)))) else Some (CTE cap'_ node'_)) = Some (CTE cap_ node_); (aa_, bb_) \<noteq> dest; ctes_of b_ (cte_map (aa_, bb_)) = Some (CTE cap'_ node'_); caps_of_state t_ = (caps_of_state a_)(dest \<mapsto> c)\<rbrakk> \<Longrightarrow> null_filter (caps_of_state a_) (aa_, bb_) \<noteq> None proof (prove)
goal (12 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t aa bb y cap node x1 x2 x2a cap' node'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap x1; mdbPrev x2a = 0; mdbNext x2a = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap x2a); ctes_of b (cte_map src) = Some (CTE (maskedAsFull x1 c') x2); safe_parent_for' (ctes_of b) (cte_map src) c'; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter (caps_of_state t) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (CTE c' (mdbFirstBadged_update (\<lambda>_. revokable' x1 c') (mdbRevocable_update (\<lambda>_. revokable' x1 c') (mdbPrev_update (\<lambda>_. cte_map src) x2)))) else Some (CTE cap' node')) = Some (CTE cap node); (aa, bb) \<noteq> dest; ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node'); caps_of_state t = (caps_of_state a)(dest \<mapsto> c); null_filter (caps_of_state a) (aa, bb) \<noteq> None\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t aa bb y cap node x1 x2 x2a cap' node' ya. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap x1; mdbPrev x2a = 0; mdbNext x2a = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap x2a); ctes_of b (cte_map src) = Some (CTE (maskedAsFull x1 c') x2); safe_parent_for' (ctes_of b) (cte_map src) c'; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter ((caps_of_state a)(dest \<mapsto> c)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (CTE c' (mdbFirstBadged_update (\<lambda>_. revokable' x1 c') (mdbRevocable_update (\<lambda>_. revokable' x1 c') (mdbPrev_update (\<lambda>_. cte_map src) x2)))) else Some (CTE cap' node')) = Some (CTE cap node); (aa, bb) \<noteq> dest; ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node'); caps_of_state t = (caps_of_state a)(dest \<mapsto> c); null_filter (caps_of_state a) (aa, bb) = Some ya\<rbrakk> \<Longrightarrow> mdbRevocable node' = mdbRevocable node
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 12 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t aa bb y cap node x1 x2 x2a cap' node' ya. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap x1; mdbPrev x2a = 0; mdbNext x2a = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap x2a); ctes_of b (cte_map src) = Some (CTE (maskedAsFull x1 c') x2); safe_parent_for' (ctes_of b) (cte_map src) c'; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter ((caps_of_state a)(dest \<mapsto> c)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (CTE c' (mdbFirstBadged_update (\<lambda>_. revokable' x1 c') (mdbRevocable_update (\<lambda>_. revokable' x1 c') (mdbPrev_update (\<lambda>_. cte_map src) x2)))) else Some (CTE cap' node')) = Some (CTE cap node); (aa, bb) \<noteq> dest; ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node'); caps_of_state t = (caps_of_state a)(dest \<mapsto> c); null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> mdbRevocable node' = mdbRevocable node
 2. \<And>src_cap a b ba s'' s''a s''b t aa bb y cap node x1 x2 x2a cap' node' ya. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap x1; mdbPrev x2a = 0; mdbNext x2a = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap x2a); ctes_of b (cte_map src) = Some (CTE (maskedAsFull x1 c') x2); safe_parent_for' (ctes_of b) (cte_map src) c'; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter ((caps_of_state a)(dest \<mapsto> c)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (CTE c' (mdbFirstBadged_update (\<lambda>_. revokable' x1 c') (mdbRevocable_update (\<lambda>_. revokable' x1 c') (mdbPrev_update (\<lambda>_. cte_map src) x2)))) else Some (CTE cap' node')) = Some (CTE cap node); (aa, bb) \<noteq> dest; ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node'); caps_of_state t = (caps_of_state a)(dest \<mapsto> c); null_filter (caps_of_state a) (aa, bb) = Some ya\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (aa, bb) a
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 4. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 8. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 10. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t aa bb y cap node x1 x2 x2a cap' node' ya. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap x1; mdbPrev x2a = 0; mdbNext x2a = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap x2a); ctes_of b (cte_map src) = Some (CTE (maskedAsFull x1 c') x2); safe_parent_for' (ctes_of b) (cte_map src) c'; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter ((caps_of_state a)(dest \<mapsto> c)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (CTE c' (mdbFirstBadged_update (\<lambda>_. revokable' x1 c') (mdbRevocable_update (\<lambda>_. revokable' x1 c') (mdbPrev_update (\<lambda>_. cte_map src) x2)))) else Some (CTE cap' node')) = Some (CTE cap node); (aa, bb) \<noteq> dest; ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node'); caps_of_state t = (caps_of_state a)(dest \<mapsto> c); null_filter (caps_of_state a) (aa, bb) = Some ya\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (aa, bb) a
 2. \<And>src_cap a b ba s'' s''a s''b t aa bb y cap node x1 x2 x2a cap' node' ya. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap x1; mdbPrev x2a = 0; mdbNext x2a = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap x2a); ctes_of b (cte_map src) = Some (CTE (maskedAsFull x1 c') x2); safe_parent_for' (ctes_of b) (cte_map src) c'; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter ((caps_of_state a)(dest \<mapsto> c)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (CTE c' (mdbFirstBadged_update (\<lambda>_. revokable' x1 c') (mdbRevocable_update (\<lambda>_. revokable' x1 c') (mdbPrev_update (\<lambda>_. cte_map src) x2)))) else Some (CTE cap' node')) = Some (CTE cap node); (aa, bb) \<noteq> dest; ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node'); caps_of_state t = (caps_of_state a)(dest \<mapsto> c); null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> mdbRevocable node' = mdbRevocable node
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 4. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 8. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 10. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t aa bb y cap node x1 x2 x2a cap' node' ya. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap x1; mdbPrev x2a = 0; mdbNext x2a = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap x2a); ctes_of b (cte_map src) = Some (CTE (maskedAsFull x1 c') x2); safe_parent_for' (ctes_of b) (cte_map src) c'; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter ((caps_of_state a)(dest \<mapsto> c)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (CTE c' (mdbFirstBadged_update (\<lambda>_. revokable' x1 c') (mdbRevocable_update (\<lambda>_. revokable' x1 c') (mdbPrev_update (\<lambda>_. cte_map src) x2)))) else Some (CTE cap' node')) = Some (CTE cap node); (aa, bb) \<noteq> dest; ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node'); caps_of_state t = (caps_of_state a)(dest \<mapsto> c); cte_wp_at (\<lambda>c'. c' = ya \<and> c' \<noteq> cap.NullCap) (aa, bb) a\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (aa, bb) a
 2. \<And>src_cap a b ba s'' s''a s''b t aa bb y cap node x1 x2 x2a cap' node' ya. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap x1; mdbPrev x2a = 0; mdbNext x2a = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap x2a); ctes_of b (cte_map src) = Some (CTE (maskedAsFull x1 c') x2); safe_parent_for' (ctes_of b) (cte_map src) c'; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter ((caps_of_state a)(dest \<mapsto> c)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (CTE c' (mdbFirstBadged_update (\<lambda>_. revokable' x1 c') (mdbRevocable_update (\<lambda>_. revokable' x1 c') (mdbPrev_update (\<lambda>_. cte_map src) x2)))) else Some (CTE cap' node')) = Some (CTE cap node); (aa, bb) \<noteq> dest; ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node'); caps_of_state t = (caps_of_state a)(dest \<mapsto> c); null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> mdbRevocable node' = mdbRevocable node
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 4. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 8. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 10. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t aa bb y cap node x1 x2 x2a cap' node' ya. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap x1; mdbPrev x2a = 0; mdbNext x2a = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap x2a); ctes_of b (cte_map src) = Some (CTE (maskedAsFull x1 c') x2); safe_parent_for' (ctes_of b) (cte_map src) c'; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter ((caps_of_state a)(dest \<mapsto> c)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (CTE c' (mdbFirstBadged_update (\<lambda>_. revokable' x1 c') (mdbRevocable_update (\<lambda>_. revokable' x1 c') (mdbPrev_update (\<lambda>_. cte_map src) x2)))) else Some (CTE cap' node')) = Some (CTE cap node); (aa, bb) \<noteq> dest; ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node'); caps_of_state t = (caps_of_state a)(dest \<mapsto> c); null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> mdbRevocable node' = mdbRevocable node
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 12 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t aa bb y cap node x1 x2 x2a cap' node' ya. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap x1; mdbPrev x2a = 0; mdbNext x2a = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap x2a); ctes_of b (cte_map src) = Some (CTE (maskedAsFull x1 c') x2); safe_parent_for' (ctes_of b) (cte_map src) c'; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter ((caps_of_state a)(dest \<mapsto> c)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (CTE c' (mdbFirstBadged_update (\<lambda>_. revokable' x1 c') (mdbRevocable_update (\<lambda>_. revokable' x1 c') (mdbPrev_update (\<lambda>_. cte_map src) x2)))) else Some (CTE cap' node')) = Some (CTE cap node); (aa, bb) \<noteq> dest; ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node'); caps_of_state t = (caps_of_state a)(dest \<mapsto> c); null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a; mdbRevocable node = mdbRevocable node'\<rbrakk> \<Longrightarrow> mdbRevocable node' = mdbRevocable node
 2. \<And>src_cap a b ba s'' s''a s''b t aa bb y cap node x1 x2 x2a cap' node' ya. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap x1; mdbPrev x2a = 0; mdbNext x2a = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap x2a); ctes_of b (cte_map src) = Some (CTE (maskedAsFull x1 c') x2); safe_parent_for' (ctes_of b) (cte_map src) c'; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter ((caps_of_state a)(dest \<mapsto> c)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (CTE c' (mdbFirstBadged_update (\<lambda>_. revokable' x1 c') (mdbRevocable_update (\<lambda>_. revokable' x1 c') (mdbPrev_update (\<lambda>_. cte_map src) x2)))) else Some (CTE cap' node')) = Some (CTE cap node); (aa, bb) \<noteq> dest; ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node'); caps_of_state t = (caps_of_state a)(dest \<mapsto> c); null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> mdbRevocable node = mdbRevocable node'
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 4. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 8. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 10. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t aa bb y cap node x1 x2 x2a cap' node' ya. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap x1; mdbPrev x2a = 0; mdbNext x2a = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap x2a); ctes_of b (cte_map src) = Some (CTE (maskedAsFull x1 c') x2); safe_parent_for' (ctes_of b) (cte_map src) c'; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter ((caps_of_state a)(dest \<mapsto> c)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (CTE c' (mdbFirstBadged_update (\<lambda>_. revokable' x1 c') (mdbRevocable_update (\<lambda>_. revokable' x1 c') (mdbPrev_update (\<lambda>_. cte_map src) x2)))) else Some (CTE cap' node')) = Some (CTE cap node); (aa, bb) \<noteq> dest; ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node'); caps_of_state t = (caps_of_state a)(dest \<mapsto> c); null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> mdbRevocable node = mdbRevocable node'
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 12 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t aa bb y cap node x1 x2 x2a cap' node' ya. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap x1; mdbPrev x2a = 0; mdbNext x2a = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap x2a); ctes_of b (cte_map src) = Some (CTE (maskedAsFull x1 c') x2); safe_parent_for' (ctes_of b) (cte_map src) c'; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter ((caps_of_state a)(dest \<mapsto> c)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (CTE c' (mdbFirstBadged_update (\<lambda>_. revokable' x1 c') (mdbRevocable_update (\<lambda>_. revokable' x1 c') (mdbPrev_update (\<lambda>_. cte_map src) x2)))) else Some (CTE cap' node')) = Some (CTE cap node); (aa, bb) \<noteq> dest; ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node'); caps_of_state t = (caps_of_state a)(dest \<mapsto> c); null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_map (aa, bb) \<noteq> cte_map dest\<rbrakk> \<Longrightarrow> mdbRevocable node = mdbRevocable node'
 2. \<And>src_cap a b ba s'' s''a s''b t aa bb y cap node x1 x2 x2a cap' node' ya. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap x1; mdbPrev x2a = 0; mdbNext x2a = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap x2a); ctes_of b (cte_map src) = Some (CTE (maskedAsFull x1 c') x2); safe_parent_for' (ctes_of b) (cte_map src) c'; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter ((caps_of_state a)(dest \<mapsto> c)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (CTE c' (mdbFirstBadged_update (\<lambda>_. revokable' x1 c') (mdbRevocable_update (\<lambda>_. revokable' x1 c') (mdbPrev_update (\<lambda>_. cte_map src) x2)))) else Some (CTE cap' node')) = Some (CTE cap node); (aa, bb) \<noteq> dest; ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node'); caps_of_state t = (caps_of_state a)(dest \<mapsto> c); null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> cte_map (aa, bb) \<noteq> cte_map dest
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 4. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 8. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 10. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
A total of 13 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap_ x1_; mdbPrev x2a_ = 0; mdbNext x2a_ = 0; ghost_relation (kheap a_) (gsUserPages b_) (gsCNodes b_); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a_) (cdt a_) (ctes_of b_); cdt_list_relation (cdt_list a_) (cdt a_) (ctes_of b_); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a_) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b_ (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a_ (aa, ba) = mdbRevocable node); (arch_state a_, ksArchState b_) \<in> arch_state_relation; domain_list a_ = ksDomSchedule b_; valid_objs a_; pspace_distinct a_; pspace_aligned a_; valid_mdb a_; valid_list a_; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a_; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a_; cte_wp_at (safe_parent_for (cdt a_) src c) src a_; cte_wp_at ((=) (masked_as_full src_cap_ c)) src a_; pspace_distinct' b_; pspace_aligned' b_; valid_dlist (ctes_of b_); no_0 (ctes_of b_); mdb_chain_0 (ctes_of b_); valid_badges (ctes_of b_); caps_contained' (ctes_of b_); mdb_chunked (ctes_of b_); untyped_mdb' (ctes_of b_); untyped_inc' (ctes_of b_); valid_nullcaps (ctes_of b_); ut_revocable' (ctes_of b_); class_links (ctes_of b_); distinct_zombies (ctes_of b_); irq_control (ctes_of b_); reply_masters_rvk_fb (ctes_of b_); valid_cap' c' b_; is_simple_cap' c'; ctes_of b_ (cte_map dest) = Some (CTE capability.NullCap x2a_); ctes_of b_ (cte_map src) = Some (CTE (maskedAsFull x1_ c') x2_); safe_parent_for' (ctes_of b_) (cte_map src) c'; cdt t_ = cdt a_; cdt_list t_ = cdt_list a_; ekheap t_ = ekheap a_; is_original_cap t_ = is_original_cap a_; (arch_state t_, ksArchState b_) \<in> arch_state_relation; domain_list t_ = ksDomSchedule s''_; mdb_insert_abs (cdt a_) src dest; no_mloop (cdt a_); pspace_aligned' s''_; pspace_distinct' s''_; pspace_aligned' s''a_; pspace_distinct' s''a_; pspace_aligned' s''b_; pspace_distinct' s''b_; pspace_aligned' ba_; pspace_distinct' ba_; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap_ (is_original_cap a_ src) c (revokable src_cap_ c); null_filter ((caps_of_state a_)(dest \<mapsto> c)) (aa_, bb_) = Some y_; (if cte_map (aa_, bb_) = cte_map dest then Some (CTE c' (mdbFirstBadged_update (\<lambda>_. revokable' x1_ c') (mdbRevocable_update (\<lambda>_. revokable' x1_ c') (mdbPrev_update (\<lambda>_. cte_map src) x2_)))) else Some (CTE cap'_ node'_)) = Some (CTE cap_ node_); (aa_, bb_) \<noteq> dest; ctes_of b_ (cte_map (aa_, bb_)) = Some (CTE cap'_ node'_); caps_of_state t_ = (caps_of_state a_)(dest \<mapsto> c); null_filter (caps_of_state a_) (aa_, bb_) = Some ya_; cte_wp_at (\<lambda>_. True) (aa_, bb_) a_; cte_map (aa_, bb_) \<noteq> cte_map dest\<rbrakk> \<Longrightarrow> mdbRevocable node_ = mdbRevocable node'_ proof (prove)
goal (12 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t aa bb y cap node x1 x2 x2a cap' node' ya. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap x1; mdbPrev x2a = 0; mdbNext x2a = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap x2a); ctes_of b (cte_map src) = Some (CTE (maskedAsFull x1 c') x2); safe_parent_for' (ctes_of b) (cte_map src) c'; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); null_filter ((caps_of_state a)(dest \<mapsto> c)) (aa, bb) = Some y; (if cte_map (aa, bb) = cte_map dest then Some (CTE c' (mdbFirstBadged_update (\<lambda>_. revokable' x1 c') (mdbRevocable_update (\<lambda>_. revokable' x1 c') (mdbPrev_update (\<lambda>_. cte_map src) x2)))) else Some (CTE cap' node')) = Some (CTE cap node); (aa, bb) \<noteq> dest; ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node'); caps_of_state t = (caps_of_state a)(dest \<mapsto> c); null_filter (caps_of_state a) (aa, bb) = Some ya; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> cte_map (aa, bb) \<noteq> cte_map dest
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 3. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 7. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 9. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 src_cap srcCTE rv rv'\<rbrace> set_untyped_cap_as_full src_cap c src \<lbrace>\<lambda>r. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) (masked_as_full src_cap c)) src\<rbrace>
 2. \<And>src_cap srcCTE rv rv'. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 src_cap srcCTE rv rv'\<rbrace> setUntypedCapAsFull (cteCap srcCTE) c' (cte_map src) \<lbrace>\<lambda>r. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')\<rbrace>
 3. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src) s\<rbrakk> \<Longrightarrow> (cte_wp_at ((=) src_cap) src and valid_objs and pspace_aligned and pspace_distinct and ?Q58 src_cap srcCTE rv rv') s
 4. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and ?Q'58 src_cap srcCTE rv rv') s
 5. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 6. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 7. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 8. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 9. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
 10. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and (\<lambda>y. is_simple_cap' c') and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map dest) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map src) c')) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'7) s
A total of 11 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>src_cap srcCTE rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer; mdbNext (cteMDBNode rv') = nullPointer; valid_objs s; pspace_distinct s; pspace_aligned s; valid_mdb s; valid_list s; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest s; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest s; cte_wp_at (safe_parent_for (cdt s) src c) src s; cte_wp_at ((=) src_cap) src s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>a. masked_as_full src_cap c = masked_as_full a c) src s
 2. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and (\<lambda>s. pspace_distinct' s \<and> pspace_aligned' s \<and> (valid_mdb' s \<and> cte_wp_at' (\<lambda>c. c = srcCTE) (cte_map src) s) \<and> (valid_cap' c' and cte_wp_at' ((=) srcCTE) (cte_map src)) s \<and> K (is_simple_cap' c') s \<and> (cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. cte_wp_at' ((=) rv') (cte_map dest) s \<and> cte_map dest \<noteq> cte_map src \<or> cte_map dest = cte_map src \<and> cte_wp_at' (\<lambda>c. rv' = CTE (maskedAsFull (cteCap c) c') (cteMDBNode c)) (cte_map src) s)) s \<and> (cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) s \<and> cte_map src \<noteq> cte_map src \<or> cte_map src = cte_map src \<and> cte_wp_at' (\<lambda>c. CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE) = CTE (maskedAsFull (cteCap c) c') (cteMDBNode c)) (cte_map src) s)) s \<and> safe_parent_for' (ctes_of s) (cte_map src) c' \<and> cte_wp_at' ((=) srcCTE) (cte_map src) s)) s
 3. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 4. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 5. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 6. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 7. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
 8. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and (\<lambda>y. is_simple_cap' c') and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map dest) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map src) c')) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'7) s
 9. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) = True\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (8 subgoals):
 1. \<And>src_cap srcCTE rv rv' s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); rv = cap.NullCap; cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = nullPointer \<and> mdbNext (cteMDBNode rv') = nullPointer; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c')) s\<rbrakk> \<Longrightarrow> (cte_wp_at' ((=) srcCTE) (cte_map src) and pspace_aligned' and pspace_distinct' and (\<lambda>s. pspace_distinct' s \<and> pspace_aligned' s \<and> (valid_mdb' s \<and> cte_wp_at' (\<lambda>c. c = srcCTE) (cte_map src) s) \<and> (valid_cap' c' and cte_wp_at' ((=) srcCTE) (cte_map src)) s \<and> K (is_simple_cap' c') s \<and> (cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. cte_wp_at' ((=) rv') (cte_map dest) s \<and> cte_map dest \<noteq> cte_map src \<or> cte_map dest = cte_map src \<and> cte_wp_at' (\<lambda>c. rv' = CTE (maskedAsFull (cteCap c) c') (cteMDBNode c)) (cte_map src) s)) s \<and> (cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. cte_wp_at' ((=) (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE))) (cte_map src) s \<and> cte_map src \<noteq> cte_map src \<or> cte_map src = cte_map src \<and> cte_wp_at' (\<lambda>c. CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE) = CTE (maskedAsFull (cteCap c) c') (cteMDBNode c)) (cte_map src) s)) s \<and> safe_parent_for' (ctes_of s) (cte_map src) c' \<and> cte_wp_at' ((=) srcCTE) (cte_map src) s)) s
 2. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 3. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 4. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 5. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 6. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
 7. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and (\<lambda>y. is_simple_cap' c') and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map dest) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map src) c')) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'7) s
 8. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) = True\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (7 subgoals):
 1. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q15 src_cap\<rbrace> get_cap dest \<lbrace>\<lambda>a. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = a) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) src_cap) src\<rbrace>
 2. \<And>src_cap srcCTE. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'16 srcCTE\<rbrace> getCTE (cte_map dest) \<lbrace>\<lambda>rv'. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) rv') (cte_map dest) and cte_wp_at' ((=) srcCTE) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap rv' = capability.NullCap)\<rbrace>
 3. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>\<lambda>src_cap. cte_wp_at (\<lambda>_. True) dest and ?Q15 src_cap\<rbrace>
 4. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest\<rbrakk> \<Longrightarrow> \<lbrace>?Q'7\<rbrace> getCTE (cte_map src) \<lbrace>\<lambda>srcCTE. pspace_aligned' and pspace_distinct' and ?Q'16 srcCTE\<rbrace>
 5. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and ?Q7) s
 6. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and (\<lambda>y. is_simple_cap' c') and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map dest) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map src) c')) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and ?Q'7) s
 7. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) = True\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and (\<lambda>y. src \<noteq> dest) and cte_wp_at (\<lambda>c. c = cap.NullCap) dest and (\<lambda>y. is_simple_cap c) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s)) s\<rbrakk> \<Longrightarrow> (cte_wp_at (\<lambda>_. True) src and (\<lambda>s. \<forall>cap. cte_wp_at ((=) cap) src s \<longrightarrow> (cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. \<forall>capa. cte_wp_at ((=) capa) dest s \<longrightarrow> (valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K (src \<noteq> dest) and cte_wp_at (\<lambda>c. c = capa) dest and K (is_simple_cap c) and cte_wp_at (\<lambda>_. True) dest and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src c) src s) and cte_wp_at ((=) cap) src) s)) s)) s
 2. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and (\<lambda>y. is_simple_cap' c') and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map dest) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map src) c')) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and (\<lambda>s. \<forall>cte. cte_wp_at' ((=) cte) (cte_map src) s \<longrightarrow> (pspace_aligned' and pspace_distinct' and (\<lambda>s. \<forall>ctea. cte_wp_at' ((=) ctea) (cte_map dest) s \<longrightarrow> (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) ctea) (cte_map dest) and cte_wp_at' ((=) cte) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap ctea = capability.NullCap)) s)) s)) s
 3. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) = True\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; valid_objs s; pspace_distinct s; pspace_aligned s; valid_mdb s; valid_list s; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest s; is_simple_cap c; cte_wp_at (safe_parent_for (cdt s) src c) src s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) src s \<and> ((\<exists>cap. cte_wp_at ((=) cap) src s) \<longrightarrow> cte_wp_at (\<lambda>_. True) dest s \<and> (\<forall>cap. cte_wp_at ((=) cap) dest s \<longrightarrow> cte_wp_at (\<lambda>c. c = cap) dest s \<and> cte_wp_at (\<lambda>_. True) dest s))
 2. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and (\<lambda>y. is_simple_cap' c') and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map dest) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map src) c')) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and (\<lambda>s. \<forall>cte. cte_wp_at' ((=) cte) (cte_map src) s \<longrightarrow> (pspace_aligned' and pspace_distinct' and (\<lambda>s. \<forall>ctea. cte_wp_at' ((=) ctea) (cte_map dest) s \<longrightarrow> (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) ctea) (cte_map dest) and cte_wp_at' ((=) cte) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap ctea = capability.NullCap)) s)) s)) s
 3. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) = True\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; valid_objs s_; pspace_distinct s_; pspace_aligned s_; valid_mdb s_; valid_list s_; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest s_; is_simple_cap c; cte_wp_at (safe_parent_for (cdt s_) src c) src s_\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) src s_ \<and> ((\<exists>cap. cte_wp_at ((=) cap) src s_) \<longrightarrow> cte_wp_at (\<lambda>_. True) dest s_ \<and> (\<forall>cap. cte_wp_at ((=) cap) dest s_ \<longrightarrow> cte_wp_at (\<lambda>c. c = cap) dest s_ \<and> cte_wp_at (\<lambda>_. True) dest s_)) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and (\<lambda>y. is_simple_cap' c') and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map dest) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map src) c')) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and (\<lambda>s. \<forall>cte. cte_wp_at' ((=) cte) (cte_map src) s \<longrightarrow> (pspace_aligned' and pspace_distinct' and (\<lambda>s. \<forall>ctea. cte_wp_at' ((=) ctea) (cte_map dest) s \<longrightarrow> (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) ctea) (cte_map dest) and cte_wp_at' ((=) cte) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap ctea = capability.NullCap)) s)) s)) s
 2. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) = True\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and (\<lambda>y. is_simple_cap' c') and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map dest) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map src) c')) s_\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and (\<lambda>s. \<forall>cte. cte_wp_at' ((=) cte) (cte_map src) s \<longrightarrow> (pspace_aligned' and pspace_distinct' and (\<lambda>s. \<forall>ctea. cte_wp_at' ((=) ctea) (cte_map dest) s \<longrightarrow> (pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' c' and K (is_simple_cap' c') and cte_wp_at' ((=) ctea) (cte_map dest) and cte_wp_at' ((=) cte) (cte_map src) and (\<lambda>s. safe_parent_for' (ctes_of s) src' c') and (\<lambda>s. cteCap ctea = capability.NullCap)) s)) s)) s_ proof (prove)
goal (1 subgoal):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) = True\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (1 subgoal):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t x1 x2. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) = True; srcCTE = CTE x1 x2\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (1 subgoal):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t src_cap' src_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) = True; srcCTE = CTE src_cap' src_node\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (1 subgoal):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t src_cap' src_node x1 x2. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) = True; srcCTE = CTE src_cap' src_node; rv' = CTE x1 x2\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (1 subgoal):
 1. \<And>src_cap srcCTE rv' a b ba s'' s''a s''b t src_cap' src_node x1 dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap (cteCap srcCTE); cteCap rv' = capability.NullCap; mdbPrev (cteMDBNode rv') = 0; mdbNext (cteMDBNode rv') = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some rv'; ctes_of b (cte_map src) = Some (CTE (maskedAsFull (cteCap srcCTE) c') (cteMDBNode srcCTE)); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) = True; srcCTE = CTE src_cap' src_node; rv' = CTE x1 dest_node\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) t)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then dest # cdt_list a src else cdt_list a src, p := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then cdt_list a p else list_insert_after (cdt_list a p) src dest)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c) then Some src else cdt a src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbRevocable_update (\<lambda>_. revokable' (cteCap srcCTE) c') (mdbPrev_update (\<lambda>_. cte_map src) (cteMDBNode srcCTE)))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext (cteMDBNode srcCTE)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (1 subgoal):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) t)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (2 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a \<and> safe_parent_for (cdt a) src c src_cap\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) t)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))))
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) src a \<and> safe_parent_for (cdt a) src c src_cap proof (prove)
goal (2 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) src a \<and> safe_parent_for (cdt a) src c src_cap
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a \<and> safe_parent_for (cdt a) src c src_cap\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) t)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap_ src_cap'_; mdbPrev dest_node_ = 0; mdbNext dest_node_ = 0; ghost_relation (kheap a_) (gsUserPages b_) (gsCNodes b_); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a_) (cdt a_) (ctes_of b_); cdt_list_relation (cdt_list a_) (cdt a_) (ctes_of b_); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; domain_list a_ = ksDomSchedule b_; valid_objs a_; pspace_distinct a_; pspace_aligned a_; valid_mdb a_; valid_list a_; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a_; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a_; cte_wp_at (safe_parent_for (cdt a_) src c) src a_; cte_wp_at ((=) (masked_as_full src_cap_ c)) src a_; pspace_distinct' b_; pspace_aligned' b_; valid_dlist (ctes_of b_); no_0 (ctes_of b_); mdb_chain_0 (ctes_of b_); valid_badges (ctes_of b_); caps_contained' (ctes_of b_); mdb_chunked (ctes_of b_); untyped_mdb' (ctes_of b_); untyped_inc' (ctes_of b_); valid_nullcaps (ctes_of b_); ut_revocable' (ctes_of b_); class_links (ctes_of b_); distinct_zombies (ctes_of b_); irq_control (ctes_of b_); reply_masters_rvk_fb (ctes_of b_); valid_cap' c' b_; is_simple_cap' c'; ctes_of b_ (cte_map dest) = Some (CTE capability.NullCap dest_node_); ctes_of b_ (cte_map src) = Some (CTE (maskedAsFull src_cap'_ c') src_node_); safe_parent_for' (ctes_of b_) (cte_map src) c'; ((), t_) \<in> fst (set_cap c dest a_); cdt t_ = cdt a_; cdt_list t_ = cdt_list a_; ekheap t_ = ekheap a_; is_original_cap t_ = is_original_cap a_; (arch_state t_, ksArchState b_) \<in> arch_state_relation; domain_list t_ = ksDomSchedule s''_; mdb_insert_abs (cdt a_) src dest; no_mloop (cdt a_); pspace_aligned' s''_; pspace_distinct' s''_; pspace_aligned' s''a_; pspace_distinct' s''a_; pspace_aligned' s''b_; pspace_distinct' s''b_; pspace_aligned' ba_; pspace_distinct' ba_; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap_ (is_original_cap a_ src) c (revokable src_cap_ c)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) src a_ \<and> safe_parent_for (cdt a_) src c src_cap_ proof (prove)
goal (1 subgoal):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a \<and> safe_parent_for (cdt a) src c src_cap\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) t)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (1 subgoal):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) t)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (2 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) t)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))))
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap\<rbrakk> \<Longrightarrow> mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node proof (prove)
goal (2 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap\<rbrakk> \<Longrightarrow> mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) t)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (4 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap\<rbrakk> \<Longrightarrow> mdb_ptr (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap\<rbrakk> \<Longrightarrow> mdb_ptr (ctes_of b) (cte_map dest) capability.NullCap dest_node
 3. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap\<rbrakk> \<Longrightarrow> mdb_insert_axioms (ctes_of b) (cte_map src) (cte_map dest) capability.NullCap dest_node
 4. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) t)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (5 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap\<rbrakk> \<Longrightarrow> vmdb (ctes_of b)
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap\<rbrakk> \<Longrightarrow> mdb_ptr_axioms (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node
 3. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap\<rbrakk> \<Longrightarrow> mdb_ptr (ctes_of b) (cte_map dest) capability.NullCap dest_node
 4. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap\<rbrakk> \<Longrightarrow> mdb_insert_axioms (ctes_of b) (cte_map src) (cte_map dest) capability.NullCap dest_node
 5. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) t)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (4 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap\<rbrakk> \<Longrightarrow> mdb_ptr_axioms (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap\<rbrakk> \<Longrightarrow> mdb_ptr (ctes_of b) (cte_map dest) capability.NullCap dest_node
 3. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap\<rbrakk> \<Longrightarrow> mdb_insert_axioms (ctes_of b) (cte_map src) (cte_map dest) capability.NullCap dest_node
 4. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) t)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (3 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap\<rbrakk> \<Longrightarrow> mdb_ptr (ctes_of b) (cte_map dest) capability.NullCap dest_node
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap\<rbrakk> \<Longrightarrow> mdb_insert_axioms (ctes_of b) (cte_map src) (cte_map dest) capability.NullCap dest_node
 3. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) t)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (4 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap\<rbrakk> \<Longrightarrow> vmdb (ctes_of b)
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap\<rbrakk> \<Longrightarrow> mdb_ptr_axioms (ctes_of b) (cte_map dest) capability.NullCap dest_node
 3. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap\<rbrakk> \<Longrightarrow> mdb_insert_axioms (ctes_of b) (cte_map src) (cte_map dest) capability.NullCap dest_node
 4. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) t)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (3 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap\<rbrakk> \<Longrightarrow> mdb_ptr_axioms (ctes_of b) (cte_map dest) capability.NullCap dest_node
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap\<rbrakk> \<Longrightarrow> mdb_insert_axioms (ctes_of b) (cte_map src) (cte_map dest) capability.NullCap dest_node
 3. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) t)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (2 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap\<rbrakk> \<Longrightarrow> mdb_insert_axioms (ctes_of b) (cte_map src) (cte_map dest) capability.NullCap dest_node
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) t)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (3 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap\<rbrakk> \<Longrightarrow> capability.NullCap = capability.NullCap
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap\<rbrakk> \<Longrightarrow> cte_map src \<noteq> cte_map dest
 3. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) t)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (2 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap\<rbrakk> \<Longrightarrow> cte_map src \<noteq> cte_map dest
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) t)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (1 subgoal):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) t)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) \<and> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (2 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (cdt_list_update (\<lambda>_. case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) t)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest))))
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (2 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node\<rbrakk> \<Longrightarrow> \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) t \<longrightarrow> cte_map ` descendants_of (aa, ba) ((cdt a)(dest \<mapsto> src)) = descendants_of' (cte_map (aa, ba)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest))))
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (2 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) t\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) ((cdt a)(dest \<mapsto> src)) = descendants_of' (cte_map (aa, bb)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest))))
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (3 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) t\<rbrakk> \<Longrightarrow> is_simple_cap' c'
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) t; mdb_insert_simple_axioms (ctes_of b) (cte_map src) c'\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) ((cdt a)(dest \<mapsto> src)) = descendants_of' (cte_map (aa, bb)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest))))
 3. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (2 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; cte_wp_at (\<lambda>_. True) (aa, bb) t; mdb_insert_simple_axioms (ctes_of b) (cte_map src) c'\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) ((cdt a)(dest \<mapsto> src)) = descendants_of' (cte_map (aa, bb)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest))))
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (2 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; cte_wp_at (\<lambda>_. True) (aa, bb) t; mdb_insert_simple_axioms (ctes_of b) (cte_map src) c'; mdb_insert_simple (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node c'\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) ((cdt a)(dest \<mapsto> src)) = descendants_of' (cte_map (aa, bb)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest))))
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (5 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; cte_wp_at (\<lambda>_. True) (aa, bb) t; mdb_insert_simple_axioms (ctes_of b) (cte_map src) c'; mdb_insert_simple (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node c'\<rbrakk> \<Longrightarrow> safe_parent_for' (?m1109 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb) (?p1109 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb) c'
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; cte_wp_at (\<lambda>_. True) (aa, bb) t; mdb_insert_simple_axioms (ctes_of b) (cte_map src) c'; mdb_insert_simple (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node c'\<rbrakk> \<Longrightarrow> ?m1109 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb (?p1109 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb) = Some (?cte1109 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb)
 3. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; cte_wp_at (\<lambda>_. True) (aa, bb) t; mdb_insert_simple_axioms (ctes_of b) (cte_map src) c'; mdb_insert_simple (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node c'\<rbrakk> \<Longrightarrow> cteCap (?cte1109 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb) = maskedAsFull src_cap' (?a1109 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb)
 4. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; cte_wp_at (\<lambda>_. True) (aa, bb) t; mdb_insert_simple_axioms (ctes_of b) (cte_map src) c'; mdb_insert_simple (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node c'; revokable' src_cap' c' = revokable' (maskedAsFull src_cap' (?a1109 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb)) c'\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) ((cdt a)(dest \<mapsto> src)) = descendants_of' (cte_map (aa, bb)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest))))
 5. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (2 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; cte_wp_at (\<lambda>_. True) (aa, bb) t; mdb_insert_simple_axioms (ctes_of b) (cte_map src) c'; mdb_insert_simple (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node c'; revokable' src_cap' c' = revokable' (maskedAsFull src_cap' c') c'\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) ((cdt a)(dest \<mapsto> src)) = descendants_of' (cte_map (aa, bb)) (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' (maskedAsFull src_cap' c') c') (mdbRevocable_update (\<lambda>_. revokable' (maskedAsFull src_cap' c') c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest))))
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (3 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; cte_wp_at (\<lambda>_. True) (aa, bb) t; mdb_insert_simple_axioms (ctes_of b) (cte_map src) c'; mdb_insert_simple (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node c'; revokable' src_cap' c' = revokable' (maskedAsFull src_cap' c') c'\<rbrakk> \<Longrightarrow> mdb_insert_simple (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) (?dest_cap1114 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb) (?dest_node1114 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb) c'
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; cte_wp_at (\<lambda>_. True) (aa, bb) t; mdb_insert_simple_axioms (ctes_of b) (cte_map src) c'; mdb_insert_simple (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node c'; revokable' src_cap' c' = revokable' (maskedAsFull src_cap' c') c'\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) ((cdt a)(dest \<mapsto> src)) = (if cte_map src \<in> descendants_of' (cte_map (aa, bb)) (ctes_of b) \<or> cte_map (aa, bb) = cte_map src then descendants_of' (cte_map (aa, bb)) (ctes_of b) \<union> {cte_map dest} else descendants_of' (cte_map (aa, bb)) (ctes_of b))
 3. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (2 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; cte_wp_at (\<lambda>_. True) (aa, bb) t; mdb_insert_simple_axioms (ctes_of b) (cte_map src) c'; mdb_insert_simple (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node c'; revokable' src_cap' c' = revokable' (maskedAsFull src_cap' c') c'\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) ((cdt a)(dest \<mapsto> src)) = (if cte_map src \<in> descendants_of' (cte_map (aa, bb)) (ctes_of b) \<or> cte_map (aa, bb) = cte_map src then descendants_of' (cte_map (aa, bb)) (ctes_of b) \<union> {cte_map dest} else descendants_of' (cte_map (aa, bb)) (ctes_of b))
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (2 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; cte_wp_at (\<lambda>_. True) (aa, bb) t; mdb_insert_simple_axioms (ctes_of b) (cte_map src) c'; mdb_insert_simple (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node c'; revokable' src_cap' c' = revokable' (maskedAsFull src_cap' c') c'\<rbrakk> \<Longrightarrow> cte_map ` (if src \<in> descendants_of (aa, bb) (cdt a) \<or> (aa, bb) = src then descendants_of (aa, bb) (cdt a) \<union> {dest} else descendants_of (aa, bb) (cdt a)) = (if cte_map src \<in> descendants_of' (cte_map (aa, bb)) (ctes_of b) \<or> cte_map (aa, bb) = cte_map src then descendants_of' (cte_map (aa, bb)) (ctes_of b) \<union> {cte_map dest} else descendants_of' (cte_map (aa, bb)) (ctes_of b))
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (2 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; cte_wp_at (\<lambda>_. True) (aa, bb) t; mdb_insert_simple_axioms (ctes_of b) (cte_map src) c'; mdb_insert_simple (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node c'; revokable' src_cap' c' = revokable' (maskedAsFull src_cap' c') c'; caps_of_state t = (caps_of_state a)(dest \<mapsto> c)\<rbrakk> \<Longrightarrow> cte_map ` (if src \<in> descendants_of (aa, bb) (cdt a) \<or> (aa, bb) = src then descendants_of (aa, bb) (cdt a) \<union> {dest} else descendants_of (aa, bb) (cdt a)) = (if cte_map src \<in> descendants_of' (cte_map (aa, bb)) (ctes_of b) \<or> cte_map (aa, bb) = cte_map src then descendants_of' (cte_map (aa, bb)) (ctes_of b) \<union> {cte_map dest} else descendants_of' (cte_map (aa, bb)) (ctes_of b))
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (3 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; cte_wp_at (\<lambda>_. True) (aa, bb) t; mdb_insert_simple_axioms (ctes_of b) (cte_map src) c'; mdb_insert_simple (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node c'; revokable' src_cap' c' = revokable' (maskedAsFull src_cap' c') c'; caps_of_state t = (caps_of_state a)(dest \<mapsto> c); cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> cte_map ` (if src \<in> descendants_of (aa, bb) (cdt a) \<or> (aa, bb) = src then descendants_of (aa, bb) (cdt a) \<union> {dest} else descendants_of (aa, bb) (cdt a)) = (if cte_map src \<in> descendants_of' (cte_map (aa, bb)) (ctes_of b) \<or> cte_map (aa, bb) = cte_map src then descendants_of' (cte_map (aa, bb)) (ctes_of b) \<union> {cte_map dest} else descendants_of' (cte_map (aa, bb)) (ctes_of b))
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; cte_wp_at (\<lambda>_. True) (aa, bb) t; mdb_insert_simple_axioms (ctes_of b) (cte_map src) c'; mdb_insert_simple (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node c'; revokable' src_cap' c' = revokable' (maskedAsFull src_cap' c') c'; caps_of_state t = (caps_of_state a)(dest \<mapsto> c)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (aa, bb) a
 3. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (3 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; cte_wp_at (\<lambda>_. True) (aa, bb) t; mdb_insert_simple_axioms (ctes_of b) (cte_map src) c'; mdb_insert_simple (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node c'; revokable' src_cap' c' = revokable' (maskedAsFull src_cap' c') c'; caps_of_state t = (caps_of_state a)(dest \<mapsto> c)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (aa, bb) a
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; cte_wp_at (\<lambda>_. True) (aa, bb) t; mdb_insert_simple_axioms (ctes_of b) (cte_map src) c'; mdb_insert_simple (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node c'; revokable' src_cap' c' = revokable' (maskedAsFull src_cap' c') c'; caps_of_state t = (caps_of_state a)(dest \<mapsto> c); cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> cte_map ` (if src \<in> descendants_of (aa, bb) (cdt a) \<or> (aa, bb) = src then descendants_of (aa, bb) (cdt a) \<union> {dest} else descendants_of (aa, bb) (cdt a)) = (if cte_map src \<in> descendants_of' (cte_map (aa, bb)) (ctes_of b) \<or> cte_map (aa, bb) = cte_map src then descendants_of' (cte_map (aa, bb)) (ctes_of b) \<union> {cte_map dest} else descendants_of' (cte_map (aa, bb)) (ctes_of b))
 3. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (2 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; cte_wp_at (\<lambda>_. True) (aa, bb) t; mdb_insert_simple_axioms (ctes_of b) (cte_map src) c'; mdb_insert_simple (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node c'; revokable' src_cap' c' = revokable' (maskedAsFull src_cap' c') c'; caps_of_state t = (caps_of_state a)(dest \<mapsto> c); cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> cte_map ` (if src \<in> descendants_of (aa, bb) (cdt a) \<or> (aa, bb) = src then descendants_of (aa, bb) (cdt a) \<union> {dest} else descendants_of (aa, bb) (cdt a)) = (if cte_map src \<in> descendants_of' (cte_map (aa, bb)) (ctes_of b) \<or> cte_map (aa, bb) = cte_map src then descendants_of' (cte_map (aa, bb)) (ctes_of b) \<union> {cte_map dest} else descendants_of' (cte_map (aa, bb)) (ctes_of b))
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (2 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; cte_wp_at (\<lambda>_. True) (aa, bb) t; mdb_insert_simple_axioms (ctes_of b) (cte_map src) c'; mdb_insert_simple (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node c'; revokable' src_cap' c' = revokable' (maskedAsFull src_cap' c') c'; caps_of_state t = (caps_of_state a)(dest \<mapsto> c); cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> src \<notin> descendants_of (aa, bb) (cdt a) \<longrightarrow> (aa, bb) \<noteq> src \<longrightarrow> cte_map (aa, bb) = cte_map src \<longrightarrow> descendants_of' (cte_map src) (ctes_of b) = insert (cte_map dest) (descendants_of' (cte_map src) (ctes_of b))
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (2 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; cte_wp_at (\<lambda>_. True) (aa, bb) t; mdb_insert_simple_axioms (ctes_of b) (cte_map src) c'; mdb_insert_simple (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node c'; revokable' src_cap' c' = revokable' (maskedAsFull src_cap' c') c'; caps_of_state t = (caps_of_state a)(dest \<mapsto> c); cte_wp_at (\<lambda>_. True) (aa, bb) a; src \<notin> descendants_of (aa, bb) (cdt a); (aa, bb) \<noteq> src; cte_map (aa, bb) = cte_map src\<rbrakk> \<Longrightarrow> descendants_of' (cte_map src) (ctes_of b) = insert (cte_map dest) (descendants_of' (cte_map src) (ctes_of b))
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (2 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; cte_wp_at (\<lambda>_. True) (aa, bb) t; mdb_insert_simple_axioms (ctes_of b) (cte_map src) c'; mdb_insert_simple (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node c'; revokable' src_cap' c' = revokable' (maskedAsFull src_cap' c') c'; caps_of_state t = (caps_of_state a)(dest \<mapsto> c); cte_wp_at (\<lambda>_. True) (aa, bb) a; src \<notin> descendants_of (aa, bb) (cdt a); cte_map (aa, bb) = cte_map src; cte_map src \<noteq> cte_map dest; cte_map (aa, bb) \<noteq> cte_map src\<rbrakk> \<Longrightarrow> descendants_of' (cte_map src) (ctes_of b) = insert (cte_map dest) (descendants_of' (cte_map src) (ctes_of b))
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (1 subgoal):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (1 subgoal):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)))) proof (prove)
goal (1 subgoal):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>c cap node. ctes_of b (cte_map c) = Some (CTE cap node) \<longrightarrow> (case next_slot c (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node\<rbrakk> \<Longrightarrow> \<forall>c cap node. modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map c) = Some (CTE cap node) \<longrightarrow> (case next_slot c (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next) proof (prove)
goal (2 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>c cap node. ctes_of b (cte_map c) = Some (CTE cap node) \<longrightarrow> (case next_slot c (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a)\<rbrakk> \<Longrightarrow> \<forall>c cap node. modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map c) = Some (CTE cap node) \<longrightarrow> (case next_slot c (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next)
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>c cap node. ctes_of b (cte_map c) = Some (CTE cap node) \<longrightarrow> (case next_slot c (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node\<rbrakk> \<Longrightarrow> no_mloop (cdt a) \<and> finite_depth (cdt a) proof (prove)
goal (2 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>c cap node. ctes_of b (cte_map c) = Some (CTE cap node) \<longrightarrow> (case next_slot c (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node\<rbrakk> \<Longrightarrow> no_mloop (cdt a) \<and> finite_depth (cdt a)
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>c cap node. ctes_of b (cte_map c) = Some (CTE cap node) \<longrightarrow> (case next_slot c (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a)\<rbrakk> \<Longrightarrow> \<forall>c cap node. modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map c) = Some (CTE cap node) \<longrightarrow> (case next_slot c (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next) proof (prove)
goal (1 subgoal):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>c cap node. ctes_of b (cte_map c) = Some (CTE cap node) \<longrightarrow> (case next_slot c (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a)\<rbrakk> \<Longrightarrow> \<forall>c cap node. modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map c) = Some (CTE cap node) \<longrightarrow> (case next_slot c (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next) proof (prove)
goal (1 subgoal):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>c cap node. ctes_of b (cte_map c) = Some (CTE cap node) \<longrightarrow> (case next_slot c (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; no_mloop (cdt a); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> case next_slot ca (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (1 subgoal):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> case next_slot ca (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p)) ((cdt a)(dest \<mapsto> src)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (7 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> mdb_insert_abs (?ma1169 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node) (?src1169 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node) (?dest1169 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node)
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> valid_list_2 (?ta1169 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node) (?ma1169 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node)
 3. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> finite_depth (?ma1169 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node)
 4. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> no_mloop (?ma1169 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node)
 5. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (?ta1169 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node)(?src1169 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node := ?dest1169 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node # ?ta1169 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node (?src1169 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node)) = (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p))
 6. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (?ma1169 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node)(?dest1169 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node \<mapsto> ?src1169 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node) = (cdt a)(dest \<mapsto> src)
 7. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> case if ca = ?src1169 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node then Some (?dest1169 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node) else if ca = ?dest1169 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node then next_slot (?src1169 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node) (?ta1169 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node) (?ma1169 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node) else next_slot ca (?ta1169 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node) (?ma1169 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (cdt_list a)(src := dest # cdt_list a src) = (case cdt a src of None \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src) | Some p \<Rightarrow> (cdt_list a)(src := dest # cdt_list a src, p := cdt_list a p))
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> case if ca = src then Some dest else if ca = dest then next_slot src (cdt_list a) (cdt a) else next_slot ca (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>\<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (\<forall>ab b. next_slot (aa, ba) (cdt_list a) (cdt a) = Some (ab, b) \<longrightarrow> mdbNext node = cte_map (ab, b)); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); no_mloop (cdt a); finite_depth (cdt a)\<rbrakk> \<Longrightarrow> \<forall>aa b. cdt a src = Some (aa, b) \<longrightarrow> (cdt_list a)(src := dest # cdt_list a src) = (cdt_list a)(src := dest # cdt_list a src, (aa, b) := cdt_list a (aa, b))
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> case if ca = src then Some dest else if ca = dest then next_slot src (cdt_list a) (cdt a) else next_slot ca (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node aa bb. \<lbrakk>\<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (\<forall>ab b. next_slot (aa, ba) (cdt_list a) (cdt a) = Some (ab, b) \<longrightarrow> mdbNext node = cte_map (ab, b)); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); no_mloop (cdt a); finite_depth (cdt a); cdt a src = Some (aa, bb)\<rbrakk> \<Longrightarrow> (cdt_list a)(src := dest # cdt_list a src) = (cdt_list a)(src := dest # cdt_list a src, (aa, bb) := cdt_list a (aa, bb))
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> case if ca = src then Some dest else if ca = dest then next_slot src (cdt_list a) (cdt a) else next_slot ca (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (3 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node aa bb. \<lbrakk>\<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (\<forall>ab b. next_slot (aa, ba) (cdt_list a) (cdt a) = Some (ab, b) \<longrightarrow> mdbNext node = cte_map (ab, b)); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); no_mloop (cdt a); finite_depth (cdt a); cdt a src = Some (aa, bb); src \<noteq> (aa, bb)\<rbrakk> \<Longrightarrow> (cdt_list a)(src := dest # cdt_list a src) = (cdt_list a)(src := dest # cdt_list a src, (aa, bb) := cdt_list a (aa, bb))
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node aa bb. \<lbrakk>\<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (\<forall>ab b. next_slot (aa, ba) (cdt_list a) (cdt a) = Some (ab, b) \<longrightarrow> mdbNext node = cte_map (ab, b)); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); no_mloop (cdt a); finite_depth (cdt a); cdt a src = Some (aa, bb)\<rbrakk> \<Longrightarrow> src \<noteq> (aa, bb)
 3. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> case if ca = src then Some dest else if ca = dest then next_slot src (cdt_list a) (cdt a) else next_slot ca (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (3 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node aa bb. \<lbrakk>\<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (\<forall>ab b. next_slot (aa, ba) (cdt_list a) (cdt a) = Some (ab, b) \<longrightarrow> mdbNext node = cte_map (ab, b)); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); no_mloop (cdt a); finite_depth (cdt a); cdt a src = Some (aa, bb)\<rbrakk> \<Longrightarrow> src \<noteq> (aa, bb)
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node aa bb. \<lbrakk>\<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (\<forall>ab b. next_slot (aa, ba) (cdt_list a) (cdt a) = Some (ab, b) \<longrightarrow> mdbNext node = cte_map (ab, b)); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); no_mloop (cdt a); finite_depth (cdt a); cdt a src = Some (aa, bb); src \<noteq> (aa, bb)\<rbrakk> \<Longrightarrow> (cdt_list a)(src := dest # cdt_list a src) = (cdt_list a)(src := dest # cdt_list a src, (aa, bb) := cdt_list a (aa, bb))
 3. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> case if ca = src then Some dest else if ca = dest then next_slot src (cdt_list a) (cdt a) else next_slot ca (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (3 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node aa bb. \<lbrakk>\<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (\<forall>ab b. next_slot (aa, ba) (cdt_list a) (cdt a) = Some (ab, b) \<longrightarrow> mdbNext node = cte_map (ab, b)); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); no_mloop (cdt a); finite_depth (cdt a); cdt a src = Some (aa, bb); src = (aa, bb)\<rbrakk> \<Longrightarrow> False
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node aa bb. \<lbrakk>\<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (\<forall>ab b. next_slot (aa, ba) (cdt_list a) (cdt a) = Some (ab, b) \<longrightarrow> mdbNext node = cte_map (ab, b)); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); no_mloop (cdt a); finite_depth (cdt a); cdt a src = Some (aa, bb); src \<noteq> (aa, bb)\<rbrakk> \<Longrightarrow> (cdt_list a)(src := dest # cdt_list a src) = (cdt_list a)(src := dest # cdt_list a src, (aa, bb) := cdt_list a (aa, bb))
 3. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> case if ca = src then Some dest else if ca = dest then next_slot src (cdt_list a) (cdt a) else next_slot ca (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node aa bb. \<lbrakk>\<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (\<forall>ab b. next_slot (aa, ba) (cdt_list a) (cdt a) = Some (ab, b) \<longrightarrow> mdbNext node = cte_map (ab, b)); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); no_mloop (cdt a); finite_depth (cdt a); cdt a src = Some (aa, bb); src \<noteq> (aa, bb)\<rbrakk> \<Longrightarrow> (cdt_list a)(src := dest # cdt_list a src) = (cdt_list a)(src := dest # cdt_list a src, (aa, bb) := cdt_list a (aa, bb))
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> case if ca = src then Some dest else if ca = dest then next_slot src (cdt_list a) (cdt a) else next_slot ca (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (1 subgoal):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> case if ca = src then Some dest else if ca = dest then next_slot src (cdt_list a) (cdt a) else next_slot ca (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); ca = src\<rbrakk> \<Longrightarrow> case if ca = src then Some dest else if ca = dest then next_slot src (cdt_list a) (cdt a) else next_slot ca (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); ca \<noteq> src\<rbrakk> \<Longrightarrow> case if ca = src then Some dest else if ca = dest then next_slot src (cdt_list a) (cdt a) else next_slot ca (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map src) = Some (CTE cap node); ca = src\<rbrakk> \<Longrightarrow> mdbNext node = cte_map dest
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); ca \<noteq> src\<rbrakk> \<Longrightarrow> case if ca = src then Some dest else if ca = dest then next_slot src (cdt_list a) (cdt a) else next_slot ca (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap node. \<lbrakk>cap_relation c c'; src' = cte_map (aa, bb); dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; (aa, bb) \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) (aa, bb) c) (aa, bb) a; cte_wp_at ((=) (masked_as_full src_cap c)) (aa, bb) a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map (aa, bb)) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map (aa, bb)) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) (aa, bb) dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map (aa, bb) \<noteq> 0; should_be_parent_of src_cap (is_original_cap a (aa, bb)) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) (aa, bb) a; safe_parent_for (cdt a) (aa, bb) c src_cap; mdb_insert (ctes_of b) (cte_map (aa, bb)) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; (if cte_map (aa, bb) = mdbNext src_node then map_option (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (map_option (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest))) (if mdbNext src_node = cte_map dest then Some (CTE c' (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map dest) src_node)))) else Some (CTE (maskedAsFull src_cap' c') src_node))) else map_option (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest))) (if cte_map (aa, bb) = cte_map dest then Some (CTE c' (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map dest) src_node)))) else Some (CTE (maskedAsFull src_cap' c') src_node))) = Some (CTE cap node); src = (aa, bb); no_mloop (cdt a); finite_depth (cdt a)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map dest
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); ca \<noteq> src\<rbrakk> \<Longrightarrow> case if ca = src then Some dest else if ca = dest then next_slot src (cdt_list a) (cdt a) else next_slot ca (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation c c'; src' = cte_map (aa_, bb_); dest' = cte_map dest; cap_relation src_cap_ src_cap'_; mdbPrev dest_node_ = 0; mdbNext dest_node_ = 0; ghost_relation (kheap a_) (gsUserPages b_) (gsCNodes b_); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a_) (cdt a_) (ctes_of b_); \<forall>aa ba cap node. ctes_of b_ (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a_) (cdt a_) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; domain_list a_ = ksDomSchedule b_; valid_objs a_; pspace_distinct a_; pspace_aligned a_; valid_mdb a_; valid_list a_; (aa_, bb_) \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a_; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a_; cte_wp_at (safe_parent_for (cdt a_) (aa_, bb_) c) (aa_, bb_) a_; cte_wp_at ((=) (masked_as_full src_cap_ c)) (aa_, bb_) a_; pspace_distinct' b_; pspace_aligned' b_; valid_dlist (ctes_of b_); no_0 (ctes_of b_); mdb_chain_0 (ctes_of b_); valid_badges (ctes_of b_); caps_contained' (ctes_of b_); mdb_chunked (ctes_of b_); untyped_mdb' (ctes_of b_); untyped_inc' (ctes_of b_); valid_nullcaps (ctes_of b_); ut_revocable' (ctes_of b_); class_links (ctes_of b_); distinct_zombies (ctes_of b_); irq_control (ctes_of b_); reply_masters_rvk_fb (ctes_of b_); valid_cap' c' b_; is_simple_cap' c'; ctes_of b_ (cte_map dest) = Some (CTE capability.NullCap dest_node_); ctes_of b_ (cte_map (aa_, bb_)) = Some (CTE (maskedAsFull src_cap'_ c') src_node_); safe_parent_for' (ctes_of b_) (cte_map (aa_, bb_)) c'; ((), t_) \<in> fst (set_cap c dest a_); cdt t_ = cdt a_; cdt_list t_ = cdt_list a_; ekheap t_ = ekheap a_; is_original_cap t_ = is_original_cap a_; (arch_state t_, ksArchState b_) \<in> arch_state_relation; domain_list t_ = ksDomSchedule s''_; mdb_insert_abs (cdt a_) (aa_, bb_) dest; pspace_aligned' s''_; pspace_distinct' s''_; pspace_aligned' s''a_; pspace_distinct' s''a_; pspace_aligned' s''b_; pspace_distinct' s''b_; pspace_aligned' ba_; pspace_distinct' ba_; cte_map dest \<noteq> 0; cte_map (aa_, bb_) \<noteq> 0; should_be_parent_of src_cap_ (is_original_cap a_ (aa_, bb_)) c (revokable src_cap_ c); cte_wp_at (\<lambda>_. True) (aa_, bb_) a_; safe_parent_for (cdt a_) (aa_, bb_) c src_cap_; mdb_insert (ctes_of b_) (cte_map (aa_, bb_)) (maskedAsFull src_cap'_ c') src_node_ (cte_map dest) capability.NullCap dest_node_; (if cte_map (aa_, bb_) = mdbNext src_node_ then map_option (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (map_option (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest))) (if mdbNext src_node_ = cte_map dest then Some (CTE c' (mdbFirstBadged_update (\<lambda>_. revokable' src_cap'_ c') (mdbRevocable_update (\<lambda>_. revokable' src_cap'_ c') (mdbPrev_update (\<lambda>_. cte_map dest) src_node_)))) else Some (CTE (maskedAsFull src_cap'_ c') src_node_))) else map_option (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest))) (if cte_map (aa_, bb_) = cte_map dest then Some (CTE c' (mdbFirstBadged_update (\<lambda>_. revokable' src_cap'_ c') (mdbRevocable_update (\<lambda>_. revokable' src_cap'_ c') (mdbPrev_update (\<lambda>_. cte_map dest) src_node_)))) else Some (CTE (maskedAsFull src_cap'_ c') src_node_))) = Some (CTE cap_ node_); src = (aa_, bb_); no_mloop (cdt a_); finite_depth (cdt a_)\<rbrakk> \<Longrightarrow> mdbNext node_ = cte_map dest proof (prove)
goal (1 subgoal):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); ca \<noteq> src\<rbrakk> \<Longrightarrow> case if ca = src then Some dest else if ca = dest then next_slot src (cdt_list a) (cdt a) else next_slot ca (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); ca \<noteq> src; ca = dest\<rbrakk> \<Longrightarrow> case if ca = src then Some dest else if ca = dest then next_slot src (cdt_list a) (cdt a) else next_slot ca (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); ca \<noteq> src; ca \<noteq> dest\<rbrakk> \<Longrightarrow> case if ca = src then Some dest else if ca = dest then next_slot src (cdt_list a) (cdt a) else next_slot ca (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map dest) = Some (CTE cap node); ca = dest\<rbrakk> \<Longrightarrow> case next_slot src (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); ca \<noteq> src; ca \<noteq> dest\<rbrakk> \<Longrightarrow> case if ca = src then Some dest else if ca = dest then next_slot src (cdt_list a) (cdt a) else next_slot ca (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (3 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map dest) = Some (CTE cap node); ca = dest; next_slot src (cdt_list a) (cdt a) = None\<rbrakk> \<Longrightarrow> case next_slot src (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node aa. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map dest) = Some (CTE cap node); ca = dest; next_slot src (cdt_list a) (cdt a) = Some aa\<rbrakk> \<Longrightarrow> case next_slot src (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 3. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); ca \<noteq> src; ca \<noteq> dest\<rbrakk> \<Longrightarrow> case if ca = src then Some dest else if ca = dest then next_slot src (cdt_list a) (cdt a) else next_slot ca (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node aa. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map dest) = Some (CTE cap node); ca = dest; next_slot src (cdt_list a) (cdt a) = Some aa\<rbrakk> \<Longrightarrow> case next_slot src (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); ca \<noteq> src; ca \<noteq> dest\<rbrakk> \<Longrightarrow> case if ca = src then Some dest else if ca = dest then next_slot src (cdt_list a) (cdt a) else next_slot ca (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node aa. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map dest) = Some (CTE cap node); ca = dest; next_slot src (cdt_list a) (cdt a) = Some aa\<rbrakk> \<Longrightarrow> mdbNext node = cte_map aa
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); ca \<noteq> src; ca \<noteq> dest\<rbrakk> \<Longrightarrow> case if ca = src then Some dest else if ca = dest then next_slot src (cdt_list a) (cdt a) else next_slot ca (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap node ab bc. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map (aa, bb); cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map (aa, bb)) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map (aa, bb) \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map (aa, bb)) capability.NullCap dest_node; (if cte_map (aa, bb) = mdbNext src_node then map_option (cteMDBNode_update (mdbPrev_update (\<lambda>_. mdbNext src_node))) (if mdbNext src_node = cte_map src then Some (CTE c' (mdbNext_update (\<lambda>_. cte_map src) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) else Some (CTE c' (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) else if cte_map (aa, bb) = cte_map src then Some (CTE c' (mdbNext_update (\<lambda>_. cte_map src) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) else Some (CTE c' (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) = Some (CTE cap node); next_slot src (cdt_list a) (cdt a) = Some (ab, bc); dest = (aa, bb); no_mloop (cdt a); finite_depth (cdt a)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); ca \<noteq> src; ca \<noteq> dest\<rbrakk> \<Longrightarrow> case if ca = src then Some dest else if ca = dest then next_slot src (cdt_list a) (cdt a) else next_slot ca (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (4 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbPrev_update (\<lambda>_. mdbNext src_node) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node))) = node; next_slot src (cdt_list a) (cdt a) = Some (ab, bc); dest = (aa, bb); no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = mdbNext src_node; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (mdbNext src_node) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' cap) src_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; mdbNext src_node \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (mdbNext src_node) capability.NullCap dest_node; cte_map (aa, bb) = mdbNext src_node; mdbNext src_node \<noteq> cte_map src; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node aa bb cap ab bc node dest_node. \<lbrakk>src_node = dest_node; mdbNext_update (\<lambda>_. cte_map src) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) dest_node))) = node; next_slot src (cdt_list a) (cdt a) = Some (ab, bc); dest = (aa, bb); no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map src; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; maskedAsFull src_cap' cap = capability.NullCap; ctes_of b (cte_map src) = Some (CTE capability.NullCap dest_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) capability.NullCap dest_node (cte_map src) capability.NullCap dest_node; cte_map (aa, bb) = cte_map src; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 3. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node)) = node; next_slot src (cdt_list a) (cdt a) = Some (ab, bc); dest = (aa, bb); no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map (aa, bb); cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map (aa, bb)) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' cap) src_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map (aa, bb) \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (cte_map (aa, bb)) capability.NullCap dest_node; cte_map (aa, bb) \<noteq> mdbNext src_node; cte_map (aa, bb) \<noteq> cte_map src; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 4. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); ca \<noteq> src; ca \<noteq> dest\<rbrakk> \<Longrightarrow> case if ca = src then Some dest else if ca = dest then next_slot src (cdt_list a) (cdt a) else next_slot ca (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (6 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbPrev_update (\<lambda>_. mdbNext src_node) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node))) = node; next_slot src (cdt_list a) (cdt a) = Some (ab, bc); dest = (aa, bb); no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = mdbNext src_node; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (mdbNext src_node) = Some (CTE capability.NullCap dest_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; mdbNext src_node \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (mdbNext src_node) capability.NullCap dest_node; cte_map (aa, bb) = mdbNext src_node; mdbNext src_node \<noteq> cte_map src; c' = cap\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode (CTE (maskedAsFull src_cap' cap) src_node)) \<noteq> 0
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbPrev_update (\<lambda>_. mdbNext src_node) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node))) = node; next_slot src (cdt_list a) (cdt a) = Some (ab, bc); dest = (aa, bb); no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = mdbNext src_node; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (mdbNext src_node) = Some (CTE capability.NullCap dest_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; mdbNext src_node \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (mdbNext src_node) capability.NullCap dest_node; cte_map (aa, bb) = mdbNext src_node; mdbNext src_node \<noteq> cte_map src; c' = cap\<rbrakk> \<Longrightarrow> valid_mdb' b
 3. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbPrev_update (\<lambda>_. mdbNext src_node) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node))) = node; next_slot src (cdt_list a) (cdt a) = Some (ab, bc); dest = (aa, bb); no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = mdbNext src_node; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (mdbNext src_node) = Some (CTE capability.NullCap dest_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; mdbNext src_node \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (mdbNext src_node) capability.NullCap dest_node; cte_map (aa, bb) = mdbNext src_node; mdbNext src_node \<noteq> cte_map src; c' = cap; \<exists>c. ctes_of b (mdbNext (cteMDBNode (CTE (maskedAsFull src_cap' cap) src_node))) = Some c \<and> mdbPrev (cteMDBNode c) = cte_map src\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 4. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node aa bb cap ab bc node dest_node. \<lbrakk>src_node = dest_node; mdbNext_update (\<lambda>_. cte_map src) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) dest_node))) = node; next_slot src (cdt_list a) (cdt a) = Some (ab, bc); dest = (aa, bb); no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map src; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; maskedAsFull src_cap' cap = capability.NullCap; ctes_of b (cte_map src) = Some (CTE capability.NullCap dest_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) capability.NullCap dest_node (cte_map src) capability.NullCap dest_node; cte_map (aa, bb) = cte_map src; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 5. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node)) = node; next_slot src (cdt_list a) (cdt a) = Some (ab, bc); dest = (aa, bb); no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map (aa, bb); cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map (aa, bb)) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' cap) src_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map (aa, bb) \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (cte_map (aa, bb)) capability.NullCap dest_node; cte_map (aa, bb) \<noteq> mdbNext src_node; cte_map (aa, bb) \<noteq> cte_map src; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 6. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); ca \<noteq> src; ca \<noteq> dest\<rbrakk> \<Longrightarrow> case if ca = src then Some dest else if ca = dest then next_slot src (cdt_list a) (cdt a) else next_slot ca (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (5 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbPrev_update (\<lambda>_. mdbNext src_node) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node))) = node; next_slot src (cdt_list a) (cdt a) = Some (ab, bc); dest = (aa, bb); no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = mdbNext src_node; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (mdbNext src_node) = Some (CTE capability.NullCap dest_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; mdbNext src_node \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (mdbNext src_node) capability.NullCap dest_node; cte_map (aa, bb) = mdbNext src_node; mdbNext src_node \<noteq> cte_map src; c' = cap\<rbrakk> \<Longrightarrow> valid_mdb' b
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbPrev_update (\<lambda>_. mdbNext src_node) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node))) = node; next_slot src (cdt_list a) (cdt a) = Some (ab, bc); dest = (aa, bb); no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = mdbNext src_node; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (mdbNext src_node) = Some (CTE capability.NullCap dest_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; mdbNext src_node \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (mdbNext src_node) capability.NullCap dest_node; cte_map (aa, bb) = mdbNext src_node; mdbNext src_node \<noteq> cte_map src; c' = cap; \<exists>c. ctes_of b (mdbNext (cteMDBNode (CTE (maskedAsFull src_cap' cap) src_node))) = Some c \<and> mdbPrev (cteMDBNode c) = cte_map src\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 3. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node aa bb cap ab bc node dest_node. \<lbrakk>src_node = dest_node; mdbNext_update (\<lambda>_. cte_map src) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) dest_node))) = node; next_slot src (cdt_list a) (cdt a) = Some (ab, bc); dest = (aa, bb); no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map src; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; maskedAsFull src_cap' cap = capability.NullCap; ctes_of b (cte_map src) = Some (CTE capability.NullCap dest_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) capability.NullCap dest_node (cte_map src) capability.NullCap dest_node; cte_map (aa, bb) = cte_map src; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 4. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node)) = node; next_slot src (cdt_list a) (cdt a) = Some (ab, bc); dest = (aa, bb); no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map (aa, bb); cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map (aa, bb)) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' cap) src_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map (aa, bb) \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (cte_map (aa, bb)) capability.NullCap dest_node; cte_map (aa, bb) \<noteq> mdbNext src_node; cte_map (aa, bb) \<noteq> cte_map src; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 5. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); ca \<noteq> src; ca \<noteq> dest\<rbrakk> \<Longrightarrow> case if ca = src then Some dest else if ca = dest then next_slot src (cdt_list a) (cdt a) else next_slot ca (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (4 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbPrev_update (\<lambda>_. mdbNext src_node) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node))) = node; next_slot src (cdt_list a) (cdt a) = Some (ab, bc); dest = (aa, bb); no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = mdbNext src_node; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (mdbNext src_node) = Some (CTE capability.NullCap dest_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; mdbNext src_node \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (mdbNext src_node) capability.NullCap dest_node; cte_map (aa, bb) = mdbNext src_node; mdbNext src_node \<noteq> cte_map src; c' = cap; \<exists>c. ctes_of b (mdbNext (cteMDBNode (CTE (maskedAsFull src_cap' cap) src_node))) = Some c \<and> mdbPrev (cteMDBNode c) = cte_map src\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node aa bb cap ab bc node dest_node. \<lbrakk>src_node = dest_node; mdbNext_update (\<lambda>_. cte_map src) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) dest_node))) = node; next_slot src (cdt_list a) (cdt a) = Some (ab, bc); dest = (aa, bb); no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map src; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; maskedAsFull src_cap' cap = capability.NullCap; ctes_of b (cte_map src) = Some (CTE capability.NullCap dest_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) capability.NullCap dest_node (cte_map src) capability.NullCap dest_node; cte_map (aa, bb) = cte_map src; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 3. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node)) = node; next_slot src (cdt_list a) (cdt a) = Some (ab, bc); dest = (aa, bb); no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map (aa, bb); cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map (aa, bb)) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' cap) src_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map (aa, bb) \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (cte_map (aa, bb)) capability.NullCap dest_node; cte_map (aa, bb) \<noteq> mdbNext src_node; cte_map (aa, bb) \<noteq> cte_map src; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 4. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); ca \<noteq> src; ca \<noteq> dest\<rbrakk> \<Longrightarrow> case if ca = src then Some dest else if ca = dest then next_slot src (cdt_list a) (cdt a) else next_slot ca (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (3 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node aa bb cap ab bc node dest_node. \<lbrakk>src_node = dest_node; mdbNext_update (\<lambda>_. cte_map src) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) dest_node))) = node; next_slot src (cdt_list a) (cdt a) = Some (ab, bc); dest = (aa, bb); no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map src; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; maskedAsFull src_cap' cap = capability.NullCap; ctes_of b (cte_map src) = Some (CTE capability.NullCap dest_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) capability.NullCap dest_node (cte_map src) capability.NullCap dest_node; cte_map (aa, bb) = cte_map src; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node)) = node; next_slot src (cdt_list a) (cdt a) = Some (ab, bc); dest = (aa, bb); no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map (aa, bb); cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map (aa, bb)) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' cap) src_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map (aa, bb) \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (cte_map (aa, bb)) capability.NullCap dest_node; cte_map (aa, bb) \<noteq> mdbNext src_node; cte_map (aa, bb) \<noteq> cte_map src; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 3. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); ca \<noteq> src; ca \<noteq> dest\<rbrakk> \<Longrightarrow> case if ca = src then Some dest else if ca = dest then next_slot src (cdt_list a) (cdt a) else next_slot ca (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (8 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node aa bb cap ab bc node dest_node. \<lbrakk>src_node = dest_node; mdbNext_update (\<lambda>_. cte_map src) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) dest_node))) = node; next_slot src (cdt_list a) (cdt a) = Some (ab, bc); dest = (aa, bb); no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map src; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; maskedAsFull src_cap' cap = capability.NullCap; ctes_of b (cte_map src) = Some (CTE capability.NullCap dest_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) capability.NullCap dest_node (cte_map src) capability.NullCap dest_node; c' = cap\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (aa, bb) (?s1253 src_cap a b ba s'' s''a s''b t src_cap' src_node aa bb cap ab bc node dest_node)
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node aa bb cap ab bc node dest_node. \<lbrakk>src_node = dest_node; mdbNext_update (\<lambda>_. cte_map src) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) dest_node))) = node; next_slot src (cdt_list a) (cdt a) = Some (ab, bc); dest = (aa, bb); no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map src; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; maskedAsFull src_cap' cap = capability.NullCap; ctes_of b (cte_map src) = Some (CTE capability.NullCap dest_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) capability.NullCap dest_node (cte_map src) capability.NullCap dest_node; c' = cap\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) src (?s1253 src_cap a b ba s'' s''a s''b t src_cap' src_node aa bb cap ab bc node dest_node)
 3. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node aa bb cap ab bc node dest_node. \<lbrakk>src_node = dest_node; mdbNext_update (\<lambda>_. cte_map src) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) dest_node))) = node; next_slot src (cdt_list a) (cdt a) = Some (ab, bc); dest = (aa, bb); no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map src; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; maskedAsFull src_cap' cap = capability.NullCap; ctes_of b (cte_map src) = Some (CTE capability.NullCap dest_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) capability.NullCap dest_node (cte_map src) capability.NullCap dest_node; c' = cap\<rbrakk> \<Longrightarrow> valid_objs (?s1253 src_cap a b ba s'' s''a s''b t src_cap' src_node aa bb cap ab bc node dest_node)
 4. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node aa bb cap ab bc node dest_node. \<lbrakk>src_node = dest_node; mdbNext_update (\<lambda>_. cte_map src) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) dest_node))) = node; next_slot src (cdt_list a) (cdt a) = Some (ab, bc); dest = (aa, bb); no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map src; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; maskedAsFull src_cap' cap = capability.NullCap; ctes_of b (cte_map src) = Some (CTE capability.NullCap dest_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) capability.NullCap dest_node (cte_map src) capability.NullCap dest_node; c' = cap\<rbrakk> \<Longrightarrow> pspace_aligned (?s1253 src_cap a b ba s'' s''a s''b t src_cap' src_node aa bb cap ab bc node dest_node)
 5. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node aa bb cap ab bc node dest_node. \<lbrakk>src_node = dest_node; mdbNext_update (\<lambda>_. cte_map src) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) dest_node))) = node; next_slot src (cdt_list a) (cdt a) = Some (ab, bc); dest = (aa, bb); no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map src; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; maskedAsFull src_cap' cap = capability.NullCap; ctes_of b (cte_map src) = Some (CTE capability.NullCap dest_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) capability.NullCap dest_node (cte_map src) capability.NullCap dest_node; c' = cap\<rbrakk> \<Longrightarrow> pspace_distinct (?s1253 src_cap a b ba s'' s''a s''b t src_cap' src_node aa bb cap ab bc node dest_node)
 6. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node aa bb cap ab bc node dest_node. \<lbrakk>src_node = dest_node; mdbNext_update (\<lambda>_. cte_map src) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) dest_node))) = node; next_slot src (cdt_list a) (cdt a) = Some (ab, bc); dest = (aa, bb); no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map src; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; maskedAsFull src_cap' cap = capability.NullCap; ctes_of b (cte_map src) = Some (CTE capability.NullCap dest_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) capability.NullCap dest_node (cte_map src) capability.NullCap dest_node; c' = cap; (aa, bb) = src\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 7. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node)) = node; next_slot src (cdt_list a) (cdt a) = Some (ab, bc); dest = (aa, bb); no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map (aa, bb); cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map (aa, bb)) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' cap) src_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map (aa, bb) \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (cte_map (aa, bb)) capability.NullCap dest_node; cte_map (aa, bb) \<noteq> mdbNext src_node; cte_map (aa, bb) \<noteq> cte_map src; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 8. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); ca \<noteq> src; ca \<noteq> dest\<rbrakk> \<Longrightarrow> case if ca = src then Some dest else if ca = dest then next_slot src (cdt_list a) (cdt a) else next_slot ca (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node)) = node; next_slot src (cdt_list a) (cdt a) = Some (ab, bc); dest = (aa, bb); no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map (aa, bb); cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map (aa, bb)) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' cap) src_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map (aa, bb) \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (cte_map (aa, bb)) capability.NullCap dest_node; cte_map (aa, bb) \<noteq> mdbNext src_node; cte_map (aa, bb) \<noteq> cte_map src; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); ca \<noteq> src; ca \<noteq> dest\<rbrakk> \<Longrightarrow> case if ca = src then Some dest else if ca = dest then next_slot src (cdt_list a) (cdt a) else next_slot ca (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node)) = node; next_slot src (cdt_list a) (cdt a) = Some (ab, bc); dest = (aa, bb); no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map (aa, bb); cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map (aa, bb)) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' cap) src_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map (aa, bb) \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (cte_map (aa, bb)) capability.NullCap dest_node; cte_map (aa, bb) \<noteq> mdbNext src_node; cte_map (aa, bb) \<noteq> cte_map src; c' = cap; \<forall>ba cap node. ctes_of b (cte_map (fst src, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (fst src, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); ca \<noteq> src; ca \<noteq> dest\<rbrakk> \<Longrightarrow> case if ca = src then Some dest else if ca = dest then next_slot src (cdt_list a) (cdt a) else next_slot ca (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node)) = node; next_slot src (cdt_list a) (cdt a) = Some (ab, bc); dest = (aa, bb); no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map (aa, bb); cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> (aa, bb); cte_wp_at (\<lambda>c. c = cap.NullCap) (aa, bb) a; is_simple_cap c; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map (aa, bb)) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' cap) src_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src (aa, bb); pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map (aa, bb) \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (cte_map (aa, bb)) capability.NullCap dest_node; cte_map (aa, bb) \<noteq> mdbNext src_node; cte_map (aa, bb) \<noteq> cte_map src; c' = cap; \<forall>cap node. ctes_of b (cte_map (fst src, snd src)) = Some (CTE cap node) \<longrightarrow> (case next_slot (fst src, snd src) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); ca \<noteq> src; ca \<noteq> dest\<rbrakk> \<Longrightarrow> case if ca = src then Some dest else if ca = dest then next_slot src (cdt_list a) (cdt a) else next_slot ca (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (1 subgoal):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); ca \<noteq> src; ca \<noteq> dest\<rbrakk> \<Longrightarrow> case if ca = src then Some dest else if ca = dest then next_slot src (cdt_list a) (cdt a) else next_slot ca (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (1 subgoal):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); ca \<noteq> src; ca \<noteq> dest\<rbrakk> \<Longrightarrow> case next_slot ca (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); ca \<noteq> src; ca \<noteq> dest; next_slot ca (cdt_list a) (cdt a) = None\<rbrakk> \<Longrightarrow> case next_slot ca (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node aa. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); ca \<noteq> src; ca \<noteq> dest; next_slot ca (cdt_list a) (cdt a) = Some aa\<rbrakk> \<Longrightarrow> case next_slot ca (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (1 subgoal):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node aa. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); ca \<noteq> src; ca \<noteq> dest; next_slot ca (cdt_list a) (cdt a) = Some aa\<rbrakk> \<Longrightarrow> case next_slot ca (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (1 subgoal):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node aa. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); ca \<noteq> src; ca \<noteq> dest; next_slot ca (cdt_list a) (cdt a) = Some aa\<rbrakk> \<Longrightarrow> mdbNext node = cte_map aa proof (prove)
goal (2 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node aa. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); ca \<noteq> src; ca \<noteq> dest; next_slot ca (cdt_list a) (cdt a) = Some aa; cte_wp_at (\<lambda>_. True) ca a\<rbrakk> \<Longrightarrow> mdbNext node = cte_map aa
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node aa. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); ca \<noteq> src; ca \<noteq> dest; next_slot ca (cdt_list a) (cdt a) = Some aa\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) ca a proof (prove)
goal (2 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node aa. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); ca \<noteq> src; ca \<noteq> dest; next_slot ca (cdt_list a) (cdt a) = Some aa\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) ca a
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node aa. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); ca \<noteq> src; ca \<noteq> dest; next_slot ca (cdt_list a) (cdt a) = Some aa; cte_wp_at (\<lambda>_. True) ca a\<rbrakk> \<Longrightarrow> mdbNext node = cte_map aa proof (prove)
goal (5 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node aa. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); ca \<noteq> src; ca \<noteq> dest; next_slot ca (cdt_list a) (cdt a) = Some aa\<rbrakk> \<Longrightarrow> valid_list a
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node aa. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); ca \<noteq> src; ca \<noteq> dest; next_slot ca (cdt_list a) (cdt a) = Some aa\<rbrakk> \<Longrightarrow> valid_mdb a
 3. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node aa. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); ca \<noteq> src; ca \<noteq> dest; next_slot ca (cdt_list a) (cdt a) = Some aa\<rbrakk> \<Longrightarrow> finite_depth (cdt a)
 4. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node aa. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); ca \<noteq> src; ca \<noteq> dest; next_slot ca (cdt_list a) (cdt a) = Some aa\<rbrakk> \<Longrightarrow> next_slot ca (cdt_list a) (cdt a) = Some (?n1270 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node aa)
 5. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node aa. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); ca \<noteq> src; ca \<noteq> dest; next_slot ca (cdt_list a) (cdt a) = Some aa; cte_wp_at (\<lambda>_. True) ca a\<rbrakk> \<Longrightarrow> mdbNext node = cte_map aa proof (prove)
goal (1 subgoal):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node ca cap node aa. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; no_mloop (cdt a) \<and> finite_depth (cdt a); modify_map (modify_map (modify_map (modify_map (ctes_of b) (cte_map dest) (cteCap_update (\<lambda>y. c'))) (cte_map dest) (cteMDBNode_update (\<lambda>a. mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node))))) (cte_map src) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (cte_map ca) = Some (CTE cap node); ca \<noteq> src; ca \<noteq> dest; next_slot ca (cdt_list a) (cdt a) = Some aa; cte_wp_at (\<lambda>_. True) ca a\<rbrakk> \<Longrightarrow> mdbNext node = cte_map aa proof (prove)
goal (1 subgoal):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap node ab bc. \<lbrakk>cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; (if cte_map (aa, bb) = mdbNext src_node then map_option (cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest))) (if mdbNext src_node = cte_map src then map_option (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest))) (if cte_map src = cte_map dest then Some (CTE c' (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map dest) src_node)))) else Some (CTE (maskedAsFull src_cap' c') src_node)) else if mdbNext src_node = cte_map dest then Some (CTE c' (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node)))) else ctes_of b (mdbNext src_node)) else if cte_map (aa, bb) = cte_map src then map_option (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map dest))) (if cte_map src = cte_map dest then Some (CTE c' (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map dest) src_node)))) else Some (CTE (maskedAsFull src_cap' c') src_node)) else if cte_map (aa, bb) = cte_map dest then Some (CTE c' (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' c') (mdbRevocable_update (\<lambda>_. revokable' src_cap' c') (mdbPrev_update (\<lambda>_. cte_map src) src_node)))) else ctes_of b (cte_map (aa, bb))) = Some (CTE cap node); (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc) proof (prove)
goal (7 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbPrev_update (\<lambda>_. cte_map dest) (mdbNext_update (\<lambda>_. cte_map dest) src_node) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE cap src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) cap src_node (cte_map dest) capability.NullCap dest_node; cte_map (aa, bb) = cte_map src; mdbNext src_node = cte_map src; cte_map src \<noteq> cte_map dest; maskedAsFull src_cap' c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbPrev_update (\<lambda>_. cte_map dest) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node))) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' cap) src_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (cte_map dest) capability.NullCap dest_node; cte_map (aa, bb) = cte_map dest; cte_map dest \<noteq> cte_map src; mdbNext src_node = cte_map dest; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 3. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap node ab bc. \<lbrakk>(aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; cte_map (aa, bb) = mdbNext src_node; mdbNext src_node \<noteq> cte_map src; mdbNext src_node \<noteq> cte_map dest; \<exists>z. ctes_of b (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)) z = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 4. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node aa bb cap ab bc node dest_node. \<lbrakk>dest_node = src_node; mdbNext_update (\<lambda>_. cte_map dest) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map dest) src_node))) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map dest; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev src_node = 0; mdbNext src_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap src_node); capability.NullCap = maskedAsFull src_cap' cap; safe_parent_for' (ctes_of b) (cte_map dest) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map dest) capability.NullCap src_node (cte_map dest) capability.NullCap src_node; cte_map (aa, bb) = cte_map dest; cte_map src = cte_map dest; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 5. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbNext_update (\<lambda>_. cte_map dest) src_node = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE cap src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) cap src_node (cte_map dest) capability.NullCap dest_node; cte_map src \<noteq> mdbNext src_node; cte_map (aa, bb) = cte_map src; cte_map src \<noteq> cte_map dest; maskedAsFull src_cap' c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 6. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node)) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' cap) src_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (cte_map dest) capability.NullCap dest_node; cte_map dest \<noteq> mdbNext src_node; cte_map dest \<noteq> cte_map src; cte_map (aa, bb) = cte_map dest; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 7. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap node ab bc. \<lbrakk>(aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; cte_map (aa, bb) \<noteq> mdbNext src_node; cte_map (aa, bb) \<noteq> cte_map src; cte_map (aa, bb) \<noteq> cte_map dest; ctes_of b (cte_map (aa, bb)) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc) proof (prove)
goal (12 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbPrev_update (\<lambda>_. cte_map dest) (mdbNext_update (\<lambda>_. cte_map dest) src_node) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE cap src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) cap src_node (cte_map dest) capability.NullCap dest_node; mdbNext src_node = cte_map src; cte_map src \<noteq> cte_map dest; maskedAsFull src_cap' c' = cap\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (aa, bb) (?s1356 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node)
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbPrev_update (\<lambda>_. cte_map dest) (mdbNext_update (\<lambda>_. cte_map dest) src_node) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE cap src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) cap src_node (cte_map dest) capability.NullCap dest_node; mdbNext src_node = cte_map src; cte_map src \<noteq> cte_map dest; maskedAsFull src_cap' c' = cap\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) src (?s1356 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node)
 3. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbPrev_update (\<lambda>_. cte_map dest) (mdbNext_update (\<lambda>_. cte_map dest) src_node) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE cap src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) cap src_node (cte_map dest) capability.NullCap dest_node; mdbNext src_node = cte_map src; cte_map src \<noteq> cte_map dest; maskedAsFull src_cap' c' = cap\<rbrakk> \<Longrightarrow> valid_objs (?s1356 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node)
 4. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbPrev_update (\<lambda>_. cte_map dest) (mdbNext_update (\<lambda>_. cte_map dest) src_node) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE cap src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) cap src_node (cte_map dest) capability.NullCap dest_node; mdbNext src_node = cte_map src; cte_map src \<noteq> cte_map dest; maskedAsFull src_cap' c' = cap\<rbrakk> \<Longrightarrow> pspace_aligned (?s1356 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node)
 5. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbPrev_update (\<lambda>_. cte_map dest) (mdbNext_update (\<lambda>_. cte_map dest) src_node) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE cap src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) cap src_node (cte_map dest) capability.NullCap dest_node; mdbNext src_node = cte_map src; cte_map src \<noteq> cte_map dest; maskedAsFull src_cap' c' = cap\<rbrakk> \<Longrightarrow> pspace_distinct (?s1356 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node)
 6. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbPrev_update (\<lambda>_. cte_map dest) (mdbNext_update (\<lambda>_. cte_map dest) src_node) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE cap src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) cap src_node (cte_map dest) capability.NullCap dest_node; mdbNext src_node = cte_map src; cte_map src \<noteq> cte_map dest; maskedAsFull src_cap' c' = cap; (aa, bb) = src\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 7. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbPrev_update (\<lambda>_. cte_map dest) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node))) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' cap) src_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (cte_map dest) capability.NullCap dest_node; cte_map (aa, bb) = cte_map dest; cte_map dest \<noteq> cte_map src; mdbNext src_node = cte_map dest; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 8. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap node ab bc. \<lbrakk>(aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; cte_map (aa, bb) = mdbNext src_node; mdbNext src_node \<noteq> cte_map src; mdbNext src_node \<noteq> cte_map dest; \<exists>z. ctes_of b (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)) z = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 9. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node aa bb cap ab bc node dest_node. \<lbrakk>dest_node = src_node; mdbNext_update (\<lambda>_. cte_map dest) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map dest) src_node))) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map dest; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev src_node = 0; mdbNext src_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap src_node); capability.NullCap = maskedAsFull src_cap' cap; safe_parent_for' (ctes_of b) (cte_map dest) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map dest) capability.NullCap src_node (cte_map dest) capability.NullCap src_node; cte_map (aa, bb) = cte_map dest; cte_map src = cte_map dest; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 10. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbNext_update (\<lambda>_. cte_map dest) src_node = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE cap src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) cap src_node (cte_map dest) capability.NullCap dest_node; cte_map src \<noteq> mdbNext src_node; cte_map (aa, bb) = cte_map src; cte_map src \<noteq> cte_map dest; maskedAsFull src_cap' c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
A total of 12 subgoals... proof (prove)
goal (6 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbPrev_update (\<lambda>_. cte_map dest) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node))) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' cap) src_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (cte_map dest) capability.NullCap dest_node; cte_map (aa, bb) = cte_map dest; cte_map dest \<noteq> cte_map src; mdbNext src_node = cte_map dest; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap node ab bc. \<lbrakk>(aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; cte_map (aa, bb) = mdbNext src_node; mdbNext src_node \<noteq> cte_map src; mdbNext src_node \<noteq> cte_map dest; \<exists>z. ctes_of b (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)) z = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 3. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node aa bb cap ab bc node dest_node. \<lbrakk>dest_node = src_node; mdbNext_update (\<lambda>_. cte_map dest) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map dest) src_node))) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map dest; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev src_node = 0; mdbNext src_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap src_node); capability.NullCap = maskedAsFull src_cap' cap; safe_parent_for' (ctes_of b) (cte_map dest) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map dest) capability.NullCap src_node (cte_map dest) capability.NullCap src_node; cte_map (aa, bb) = cte_map dest; cte_map src = cte_map dest; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 4. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbNext_update (\<lambda>_. cte_map dest) src_node = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE cap src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) cap src_node (cte_map dest) capability.NullCap dest_node; cte_map src \<noteq> mdbNext src_node; cte_map (aa, bb) = cte_map src; cte_map src \<noteq> cte_map dest; maskedAsFull src_cap' c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 5. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node)) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' cap) src_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (cte_map dest) capability.NullCap dest_node; cte_map dest \<noteq> mdbNext src_node; cte_map dest \<noteq> cte_map src; cte_map (aa, bb) = cte_map dest; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 6. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap node ab bc. \<lbrakk>(aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; cte_map (aa, bb) \<noteq> mdbNext src_node; cte_map (aa, bb) \<noteq> cte_map src; cte_map (aa, bb) \<noteq> cte_map dest; ctes_of b (cte_map (aa, bb)) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc) proof (prove)
goal (8 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbPrev_update (\<lambda>_. cte_map dest) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node))) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (cte_map dest) capability.NullCap dest_node; cte_map (aa, bb) = cte_map dest; cte_map dest \<noteq> cte_map src; mdbNext src_node = cte_map dest; c' = cap\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode (CTE (maskedAsFull src_cap' cap) src_node)) \<noteq> 0
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbPrev_update (\<lambda>_. cte_map dest) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node))) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (cte_map dest) capability.NullCap dest_node; cte_map (aa, bb) = cte_map dest; cte_map dest \<noteq> cte_map src; mdbNext src_node = cte_map dest; c' = cap\<rbrakk> \<Longrightarrow> valid_mdb' b
 3. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbPrev_update (\<lambda>_. cte_map dest) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node))) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (cte_map dest) capability.NullCap dest_node; cte_map (aa, bb) = cte_map dest; cte_map dest \<noteq> cte_map src; mdbNext src_node = cte_map dest; c' = cap; \<exists>c. ctes_of b (mdbNext (cteMDBNode (CTE (maskedAsFull src_cap' cap) src_node))) = Some c \<and> mdbPrev (cteMDBNode c) = cte_map src\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 4. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap node ab bc. \<lbrakk>(aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; cte_map (aa, bb) = mdbNext src_node; mdbNext src_node \<noteq> cte_map src; mdbNext src_node \<noteq> cte_map dest; \<exists>z. ctes_of b (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)) z = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 5. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node aa bb cap ab bc node dest_node. \<lbrakk>dest_node = src_node; mdbNext_update (\<lambda>_. cte_map dest) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map dest) src_node))) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map dest; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev src_node = 0; mdbNext src_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap src_node); capability.NullCap = maskedAsFull src_cap' cap; safe_parent_for' (ctes_of b) (cte_map dest) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map dest) capability.NullCap src_node (cte_map dest) capability.NullCap src_node; cte_map (aa, bb) = cte_map dest; cte_map src = cte_map dest; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 6. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbNext_update (\<lambda>_. cte_map dest) src_node = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE cap src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) cap src_node (cte_map dest) capability.NullCap dest_node; cte_map src \<noteq> mdbNext src_node; cte_map (aa, bb) = cte_map src; cte_map src \<noteq> cte_map dest; maskedAsFull src_cap' c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 7. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node)) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' cap) src_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (cte_map dest) capability.NullCap dest_node; cte_map dest \<noteq> mdbNext src_node; cte_map dest \<noteq> cte_map src; cte_map (aa, bb) = cte_map dest; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 8. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap node ab bc. \<lbrakk>(aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; cte_map (aa, bb) \<noteq> mdbNext src_node; cte_map (aa, bb) \<noteq> cte_map src; cte_map (aa, bb) \<noteq> cte_map dest; ctes_of b (cte_map (aa, bb)) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc) proof (prove)
goal (7 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbPrev_update (\<lambda>_. cte_map dest) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node))) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (cte_map dest) capability.NullCap dest_node; cte_map (aa, bb) = cte_map dest; cte_map dest \<noteq> cte_map src; mdbNext src_node = cte_map dest; c' = cap\<rbrakk> \<Longrightarrow> valid_mdb' b
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbPrev_update (\<lambda>_. cte_map dest) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node))) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (cte_map dest) capability.NullCap dest_node; cte_map (aa, bb) = cte_map dest; cte_map dest \<noteq> cte_map src; mdbNext src_node = cte_map dest; c' = cap; \<exists>c. ctes_of b (mdbNext (cteMDBNode (CTE (maskedAsFull src_cap' cap) src_node))) = Some c \<and> mdbPrev (cteMDBNode c) = cte_map src\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 3. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap node ab bc. \<lbrakk>(aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; cte_map (aa, bb) = mdbNext src_node; mdbNext src_node \<noteq> cte_map src; mdbNext src_node \<noteq> cte_map dest; \<exists>z. ctes_of b (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)) z = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 4. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node aa bb cap ab bc node dest_node. \<lbrakk>dest_node = src_node; mdbNext_update (\<lambda>_. cte_map dest) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map dest) src_node))) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map dest; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev src_node = 0; mdbNext src_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap src_node); capability.NullCap = maskedAsFull src_cap' cap; safe_parent_for' (ctes_of b) (cte_map dest) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map dest) capability.NullCap src_node (cte_map dest) capability.NullCap src_node; cte_map (aa, bb) = cte_map dest; cte_map src = cte_map dest; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 5. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbNext_update (\<lambda>_. cte_map dest) src_node = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE cap src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) cap src_node (cte_map dest) capability.NullCap dest_node; cte_map src \<noteq> mdbNext src_node; cte_map (aa, bb) = cte_map src; cte_map src \<noteq> cte_map dest; maskedAsFull src_cap' c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 6. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node)) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' cap) src_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (cte_map dest) capability.NullCap dest_node; cte_map dest \<noteq> mdbNext src_node; cte_map dest \<noteq> cte_map src; cte_map (aa, bb) = cte_map dest; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 7. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap node ab bc. \<lbrakk>(aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; cte_map (aa, bb) \<noteq> mdbNext src_node; cte_map (aa, bb) \<noteq> cte_map src; cte_map (aa, bb) \<noteq> cte_map dest; ctes_of b (cte_map (aa, bb)) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc) proof (prove)
goal (6 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbPrev_update (\<lambda>_. cte_map dest) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node))) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (cte_map dest) capability.NullCap dest_node; cte_map (aa, bb) = cte_map dest; cte_map dest \<noteq> cte_map src; mdbNext src_node = cte_map dest; c' = cap; \<exists>c. ctes_of b (mdbNext (cteMDBNode (CTE (maskedAsFull src_cap' cap) src_node))) = Some c \<and> mdbPrev (cteMDBNode c) = cte_map src\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap node ab bc. \<lbrakk>(aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; cte_map (aa, bb) = mdbNext src_node; mdbNext src_node \<noteq> cte_map src; mdbNext src_node \<noteq> cte_map dest; \<exists>z. ctes_of b (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)) z = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 3. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node aa bb cap ab bc node dest_node. \<lbrakk>dest_node = src_node; mdbNext_update (\<lambda>_. cte_map dest) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map dest) src_node))) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map dest; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev src_node = 0; mdbNext src_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap src_node); capability.NullCap = maskedAsFull src_cap' cap; safe_parent_for' (ctes_of b) (cte_map dest) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map dest) capability.NullCap src_node (cte_map dest) capability.NullCap src_node; cte_map (aa, bb) = cte_map dest; cte_map src = cte_map dest; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 4. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbNext_update (\<lambda>_. cte_map dest) src_node = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE cap src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) cap src_node (cte_map dest) capability.NullCap dest_node; cte_map src \<noteq> mdbNext src_node; cte_map (aa, bb) = cte_map src; cte_map src \<noteq> cte_map dest; maskedAsFull src_cap' c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 5. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node)) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' cap) src_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (cte_map dest) capability.NullCap dest_node; cte_map dest \<noteq> mdbNext src_node; cte_map dest \<noteq> cte_map src; cte_map (aa, bb) = cte_map dest; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 6. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap node ab bc. \<lbrakk>(aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; cte_map (aa, bb) \<noteq> mdbNext src_node; cte_map (aa, bb) \<noteq> cte_map src; cte_map (aa, bb) \<noteq> cte_map dest; ctes_of b (cte_map (aa, bb)) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc) proof (prove)
goal (5 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap node ab bc. \<lbrakk>(aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; cte_map (aa, bb) = mdbNext src_node; mdbNext src_node \<noteq> cte_map src; mdbNext src_node \<noteq> cte_map dest; \<exists>z. ctes_of b (mdbNext src_node) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)) z = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node aa bb cap ab bc node dest_node. \<lbrakk>dest_node = src_node; mdbNext_update (\<lambda>_. cte_map dest) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map dest) src_node))) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map dest; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev src_node = 0; mdbNext src_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap src_node); capability.NullCap = maskedAsFull src_cap' cap; safe_parent_for' (ctes_of b) (cte_map dest) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map dest) capability.NullCap src_node (cte_map dest) capability.NullCap src_node; cte_map (aa, bb) = cte_map dest; cte_map src = cte_map dest; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 3. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbNext_update (\<lambda>_. cte_map dest) src_node = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE cap src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) cap src_node (cte_map dest) capability.NullCap dest_node; cte_map src \<noteq> mdbNext src_node; cte_map (aa, bb) = cte_map src; cte_map src \<noteq> cte_map dest; maskedAsFull src_cap' c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 4. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node)) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' cap) src_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (cte_map dest) capability.NullCap dest_node; cte_map dest \<noteq> mdbNext src_node; cte_map dest \<noteq> cte_map src; cte_map (aa, bb) = cte_map dest; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 5. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap node ab bc. \<lbrakk>(aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; cte_map (aa, bb) \<noteq> mdbNext src_node; cte_map (aa, bb) \<noteq> cte_map src; cte_map (aa, bb) \<noteq> cte_map dest; ctes_of b (cte_map (aa, bb)) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc) proof (prove)
goal (5 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap node ab bc z. \<lbrakk>(aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; cte_map (aa, bb) = mdbNext src_node; mdbNext src_node \<noteq> cte_map src; mdbNext src_node \<noteq> cte_map dest; ctes_of b (mdbNext src_node) = Some z; cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)) z = CTE cap node\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node aa bb cap ab bc node dest_node. \<lbrakk>dest_node = src_node; mdbNext_update (\<lambda>_. cte_map dest) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map dest) src_node))) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map dest; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev src_node = 0; mdbNext src_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap src_node); capability.NullCap = maskedAsFull src_cap' cap; safe_parent_for' (ctes_of b) (cte_map dest) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map dest) capability.NullCap src_node (cte_map dest) capability.NullCap src_node; cte_map (aa, bb) = cte_map dest; cte_map src = cte_map dest; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 3. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbNext_update (\<lambda>_. cte_map dest) src_node = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE cap src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) cap src_node (cte_map dest) capability.NullCap dest_node; cte_map src \<noteq> mdbNext src_node; cte_map (aa, bb) = cte_map src; cte_map src \<noteq> cte_map dest; maskedAsFull src_cap' c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 4. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node)) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' cap) src_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (cte_map dest) capability.NullCap dest_node; cte_map dest \<noteq> mdbNext src_node; cte_map dest \<noteq> cte_map src; cte_map (aa, bb) = cte_map dest; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 5. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap node ab bc. \<lbrakk>(aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; cte_map (aa, bb) \<noteq> mdbNext src_node; cte_map (aa, bb) \<noteq> cte_map src; cte_map (aa, bb) \<noteq> cte_map dest; ctes_of b (cte_map (aa, bb)) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc) proof (prove)
goal (5 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap node ab bc z x1 x2. \<lbrakk>(aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; cte_map (aa, bb) = mdbNext src_node; mdbNext src_node \<noteq> cte_map src; mdbNext src_node \<noteq> cte_map dest; ctes_of b (mdbNext src_node) = Some z; cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)) z = CTE cap node; z = CTE x1 x2\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node aa bb cap ab bc node dest_node. \<lbrakk>dest_node = src_node; mdbNext_update (\<lambda>_. cte_map dest) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map dest) src_node))) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map dest; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev src_node = 0; mdbNext src_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap src_node); capability.NullCap = maskedAsFull src_cap' cap; safe_parent_for' (ctes_of b) (cte_map dest) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map dest) capability.NullCap src_node (cte_map dest) capability.NullCap src_node; cte_map (aa, bb) = cte_map dest; cte_map src = cte_map dest; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 3. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbNext_update (\<lambda>_. cte_map dest) src_node = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE cap src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) cap src_node (cte_map dest) capability.NullCap dest_node; cte_map src \<noteq> mdbNext src_node; cte_map (aa, bb) = cte_map src; cte_map src \<noteq> cte_map dest; maskedAsFull src_cap' c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 4. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node)) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' cap) src_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (cte_map dest) capability.NullCap dest_node; cte_map dest \<noteq> mdbNext src_node; cte_map dest \<noteq> cte_map src; cte_map (aa, bb) = cte_map dest; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 5. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap node ab bc. \<lbrakk>(aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; cte_map (aa, bb) \<noteq> mdbNext src_node; cte_map (aa, bb) \<noteq> cte_map src; cte_map (aa, bb) \<noteq> cte_map dest; ctes_of b (cte_map (aa, bb)) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc) proof (prove)
goal (5 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap node ab bc z x1 x2. \<lbrakk>(aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; cte_map (aa, bb) = mdbNext src_node; mdbNext src_node \<noteq> cte_map src; mdbNext src_node \<noteq> cte_map dest; ctes_of b (mdbNext src_node) = Some z; cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)) z = CTE cap node; z = CTE x1 x2; \<forall>ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node aa bb cap ab bc node dest_node. \<lbrakk>dest_node = src_node; mdbNext_update (\<lambda>_. cte_map dest) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map dest) src_node))) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map dest; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev src_node = 0; mdbNext src_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap src_node); capability.NullCap = maskedAsFull src_cap' cap; safe_parent_for' (ctes_of b) (cte_map dest) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map dest) capability.NullCap src_node (cte_map dest) capability.NullCap src_node; cte_map (aa, bb) = cte_map dest; cte_map src = cte_map dest; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 3. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbNext_update (\<lambda>_. cte_map dest) src_node = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE cap src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) cap src_node (cte_map dest) capability.NullCap dest_node; cte_map src \<noteq> mdbNext src_node; cte_map (aa, bb) = cte_map src; cte_map src \<noteq> cte_map dest; maskedAsFull src_cap' c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 4. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node)) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' cap) src_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (cte_map dest) capability.NullCap dest_node; cte_map dest \<noteq> mdbNext src_node; cte_map dest \<noteq> cte_map src; cte_map (aa, bb) = cte_map dest; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 5. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap node ab bc. \<lbrakk>(aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; cte_map (aa, bb) \<noteq> mdbNext src_node; cte_map (aa, bb) \<noteq> cte_map src; cte_map (aa, bb) \<noteq> cte_map dest; ctes_of b (cte_map (aa, bb)) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc) proof (prove)
goal (5 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap node ab bc z x1 x2. \<lbrakk>(aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; cte_map (aa, bb) = mdbNext src_node; mdbNext src_node \<noteq> cte_map src; mdbNext src_node \<noteq> cte_map dest; ctes_of b (mdbNext src_node) = Some z; cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map dest)) z = CTE cap node; z = CTE x1 x2; \<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node aa bb cap ab bc node dest_node. \<lbrakk>dest_node = src_node; mdbNext_update (\<lambda>_. cte_map dest) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map dest) src_node))) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map dest; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev src_node = 0; mdbNext src_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap src_node); capability.NullCap = maskedAsFull src_cap' cap; safe_parent_for' (ctes_of b) (cte_map dest) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map dest) capability.NullCap src_node (cte_map dest) capability.NullCap src_node; cte_map (aa, bb) = cte_map dest; cte_map src = cte_map dest; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 3. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbNext_update (\<lambda>_. cte_map dest) src_node = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE cap src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) cap src_node (cte_map dest) capability.NullCap dest_node; cte_map src \<noteq> mdbNext src_node; cte_map (aa, bb) = cte_map src; cte_map src \<noteq> cte_map dest; maskedAsFull src_cap' c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 4. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node)) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' cap) src_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (cte_map dest) capability.NullCap dest_node; cte_map dest \<noteq> mdbNext src_node; cte_map dest \<noteq> cte_map src; cte_map (aa, bb) = cte_map dest; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 5. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap node ab bc. \<lbrakk>(aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; cte_map (aa, bb) \<noteq> mdbNext src_node; cte_map (aa, bb) \<noteq> cte_map src; cte_map (aa, bb) \<noteq> cte_map dest; ctes_of b (cte_map (aa, bb)) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc) proof (prove)
goal (4 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node aa bb cap ab bc node dest_node. \<lbrakk>dest_node = src_node; mdbNext_update (\<lambda>_. cte_map dest) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map dest) src_node))) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map dest; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev src_node = 0; mdbNext src_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap src_node); capability.NullCap = maskedAsFull src_cap' cap; safe_parent_for' (ctes_of b) (cte_map dest) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map dest) capability.NullCap src_node (cte_map dest) capability.NullCap src_node; cte_map (aa, bb) = cte_map dest; cte_map src = cte_map dest; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbNext_update (\<lambda>_. cte_map dest) src_node = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE cap src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) cap src_node (cte_map dest) capability.NullCap dest_node; cte_map src \<noteq> mdbNext src_node; cte_map (aa, bb) = cte_map src; cte_map src \<noteq> cte_map dest; maskedAsFull src_cap' c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 3. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node)) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' cap) src_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (cte_map dest) capability.NullCap dest_node; cte_map dest \<noteq> mdbNext src_node; cte_map dest \<noteq> cte_map src; cte_map (aa, bb) = cte_map dest; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 4. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap node ab bc. \<lbrakk>(aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; cte_map (aa, bb) \<noteq> mdbNext src_node; cte_map (aa, bb) \<noteq> cte_map src; cte_map (aa, bb) \<noteq> cte_map dest; ctes_of b (cte_map (aa, bb)) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc) proof (prove)
goal (9 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node aa bb cap ab bc node dest_node. \<lbrakk>dest_node = src_node; mdbNext_update (\<lambda>_. cte_map dest) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map dest) src_node))) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map dest; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev src_node = 0; mdbNext src_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap src_node); capability.NullCap = maskedAsFull src_cap' cap; safe_parent_for' (ctes_of b) (cte_map dest) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map dest) capability.NullCap src_node (cte_map dest) capability.NullCap src_node; cte_map src = cte_map dest; c' = cap\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (aa, bb) (?s1379 src_cap a b ba s'' s''a s''b t src_cap' src_node aa bb cap ab bc node dest_node)
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node aa bb cap ab bc node dest_node. \<lbrakk>dest_node = src_node; mdbNext_update (\<lambda>_. cte_map dest) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map dest) src_node))) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map dest; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev src_node = 0; mdbNext src_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap src_node); capability.NullCap = maskedAsFull src_cap' cap; safe_parent_for' (ctes_of b) (cte_map dest) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map dest) capability.NullCap src_node (cte_map dest) capability.NullCap src_node; cte_map src = cte_map dest; c' = cap\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) dest (?s1379 src_cap a b ba s'' s''a s''b t src_cap' src_node aa bb cap ab bc node dest_node)
 3. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node aa bb cap ab bc node dest_node. \<lbrakk>dest_node = src_node; mdbNext_update (\<lambda>_. cte_map dest) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map dest) src_node))) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map dest; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev src_node = 0; mdbNext src_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap src_node); capability.NullCap = maskedAsFull src_cap' cap; safe_parent_for' (ctes_of b) (cte_map dest) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map dest) capability.NullCap src_node (cte_map dest) capability.NullCap src_node; cte_map src = cte_map dest; c' = cap\<rbrakk> \<Longrightarrow> valid_objs (?s1379 src_cap a b ba s'' s''a s''b t src_cap' src_node aa bb cap ab bc node dest_node)
 4. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node aa bb cap ab bc node dest_node. \<lbrakk>dest_node = src_node; mdbNext_update (\<lambda>_. cte_map dest) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map dest) src_node))) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map dest; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev src_node = 0; mdbNext src_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap src_node); capability.NullCap = maskedAsFull src_cap' cap; safe_parent_for' (ctes_of b) (cte_map dest) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map dest) capability.NullCap src_node (cte_map dest) capability.NullCap src_node; cte_map src = cte_map dest; c' = cap\<rbrakk> \<Longrightarrow> pspace_aligned (?s1379 src_cap a b ba s'' s''a s''b t src_cap' src_node aa bb cap ab bc node dest_node)
 5. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node aa bb cap ab bc node dest_node. \<lbrakk>dest_node = src_node; mdbNext_update (\<lambda>_. cte_map dest) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map dest) src_node))) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map dest; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev src_node = 0; mdbNext src_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap src_node); capability.NullCap = maskedAsFull src_cap' cap; safe_parent_for' (ctes_of b) (cte_map dest) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map dest) capability.NullCap src_node (cte_map dest) capability.NullCap src_node; cte_map src = cte_map dest; c' = cap\<rbrakk> \<Longrightarrow> pspace_distinct (?s1379 src_cap a b ba s'' s''a s''b t src_cap' src_node aa bb cap ab bc node dest_node)
 6. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node aa bb cap ab bc node dest_node. \<lbrakk>dest_node = src_node; mdbNext_update (\<lambda>_. cte_map dest) (mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map dest) src_node))) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map dest; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev src_node = 0; mdbNext src_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap src_node); capability.NullCap = maskedAsFull src_cap' cap; safe_parent_for' (ctes_of b) (cte_map dest) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map dest) capability.NullCap src_node (cte_map dest) capability.NullCap src_node; cte_map src = cte_map dest; c' = cap; (aa, bb) = dest\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 7. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbNext_update (\<lambda>_. cte_map dest) src_node = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE cap src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) cap src_node (cte_map dest) capability.NullCap dest_node; cte_map src \<noteq> mdbNext src_node; cte_map (aa, bb) = cte_map src; cte_map src \<noteq> cte_map dest; maskedAsFull src_cap' c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 8. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node)) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' cap) src_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (cte_map dest) capability.NullCap dest_node; cte_map dest \<noteq> mdbNext src_node; cte_map dest \<noteq> cte_map src; cte_map (aa, bb) = cte_map dest; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 9. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap node ab bc. \<lbrakk>(aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; cte_map (aa, bb) \<noteq> mdbNext src_node; cte_map (aa, bb) \<noteq> cte_map src; cte_map (aa, bb) \<noteq> cte_map dest; ctes_of b (cte_map (aa, bb)) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc) proof (prove)
goal (3 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbNext_update (\<lambda>_. cte_map dest) src_node = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE cap src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) cap src_node (cte_map dest) capability.NullCap dest_node; cte_map src \<noteq> mdbNext src_node; cte_map (aa, bb) = cte_map src; cte_map src \<noteq> cte_map dest; maskedAsFull src_cap' c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node)) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' cap) src_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (cte_map dest) capability.NullCap dest_node; cte_map dest \<noteq> mdbNext src_node; cte_map dest \<noteq> cte_map src; cte_map (aa, bb) = cte_map dest; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 3. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap node ab bc. \<lbrakk>(aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; cte_map (aa, bb) \<noteq> mdbNext src_node; cte_map (aa, bb) \<noteq> cte_map src; cte_map (aa, bb) \<noteq> cte_map dest; ctes_of b (cte_map (aa, bb)) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc) proof (prove)
goal (8 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbNext_update (\<lambda>_. cte_map dest) src_node = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE cap src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) cap src_node (cte_map dest) capability.NullCap dest_node; cte_map src \<noteq> mdbNext src_node; cte_map src \<noteq> cte_map dest; maskedAsFull src_cap' c' = cap\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (aa, bb) (?s1388 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node)
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbNext_update (\<lambda>_. cte_map dest) src_node = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE cap src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) cap src_node (cte_map dest) capability.NullCap dest_node; cte_map src \<noteq> mdbNext src_node; cte_map src \<noteq> cte_map dest; maskedAsFull src_cap' c' = cap\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) src (?s1388 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node)
 3. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbNext_update (\<lambda>_. cte_map dest) src_node = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE cap src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) cap src_node (cte_map dest) capability.NullCap dest_node; cte_map src \<noteq> mdbNext src_node; cte_map src \<noteq> cte_map dest; maskedAsFull src_cap' c' = cap\<rbrakk> \<Longrightarrow> valid_objs (?s1388 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node)
 4. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbNext_update (\<lambda>_. cte_map dest) src_node = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE cap src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) cap src_node (cte_map dest) capability.NullCap dest_node; cte_map src \<noteq> mdbNext src_node; cte_map src \<noteq> cte_map dest; maskedAsFull src_cap' c' = cap\<rbrakk> \<Longrightarrow> pspace_aligned (?s1388 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node)
 5. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbNext_update (\<lambda>_. cte_map dest) src_node = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE cap src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) cap src_node (cte_map dest) capability.NullCap dest_node; cte_map src \<noteq> mdbNext src_node; cte_map src \<noteq> cte_map dest; maskedAsFull src_cap' c' = cap\<rbrakk> \<Longrightarrow> pspace_distinct (?s1388 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node)
 6. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbNext_update (\<lambda>_. cte_map dest) src_node = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE cap src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) cap src_node (cte_map dest) capability.NullCap dest_node; cte_map src \<noteq> mdbNext src_node; cte_map src \<noteq> cte_map dest; maskedAsFull src_cap' c' = cap; (aa, bb) = src\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 7. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node)) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' cap) src_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (cte_map dest) capability.NullCap dest_node; cte_map dest \<noteq> mdbNext src_node; cte_map dest \<noteq> cte_map src; cte_map (aa, bb) = cte_map dest; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 8. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap node ab bc. \<lbrakk>(aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; cte_map (aa, bb) \<noteq> mdbNext src_node; cte_map (aa, bb) \<noteq> cte_map src; cte_map (aa, bb) \<noteq> cte_map dest; ctes_of b (cte_map (aa, bb)) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc) proof (prove)
goal (2 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node)) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' cap) src_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (cte_map dest) capability.NullCap dest_node; cte_map dest \<noteq> mdbNext src_node; cte_map dest \<noteq> cte_map src; cte_map (aa, bb) = cte_map dest; c' = cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap node ab bc. \<lbrakk>(aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; cte_map (aa, bb) \<noteq> mdbNext src_node; cte_map (aa, bb) \<noteq> cte_map src; cte_map (aa, bb) \<noteq> cte_map dest; ctes_of b (cte_map (aa, bb)) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc) proof (prove)
goal (7 subgoals):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node)) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' cap) src_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (cte_map dest) capability.NullCap dest_node; cte_map dest \<noteq> mdbNext src_node; cte_map dest \<noteq> cte_map src; c' = cap\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (aa, bb) (?s1397 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node)
 2. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node)) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' cap) src_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (cte_map dest) capability.NullCap dest_node; cte_map dest \<noteq> mdbNext src_node; cte_map dest \<noteq> cte_map src; c' = cap\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) dest (?s1397 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node)
 3. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node)) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' cap) src_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (cte_map dest) capability.NullCap dest_node; cte_map dest \<noteq> mdbNext src_node; cte_map dest \<noteq> cte_map src; c' = cap\<rbrakk> \<Longrightarrow> valid_objs (?s1397 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node)
 4. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node)) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' cap) src_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (cte_map dest) capability.NullCap dest_node; cte_map dest \<noteq> mdbNext src_node; cte_map dest \<noteq> cte_map src; c' = cap\<rbrakk> \<Longrightarrow> pspace_aligned (?s1397 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node)
 5. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node)) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' cap) src_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (cte_map dest) capability.NullCap dest_node; cte_map dest \<noteq> mdbNext src_node; cte_map dest \<noteq> cte_map src; c' = cap\<rbrakk> \<Longrightarrow> pspace_distinct (?s1397 src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node)
 6. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap ab bc node. \<lbrakk>mdbFirstBadged_update (\<lambda>_. revokable' src_cap' cap) (mdbRevocable_update (\<lambda>_. revokable' src_cap' cap) (mdbPrev_update (\<lambda>_. cte_map src) src_node)) = node; (aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c cap; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' cap b; is_simple_cap' cap; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' cap) src_node); safe_parent_for' (ctes_of b) (cte_map src) cap; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' cap) src_node (cte_map dest) capability.NullCap dest_node; cte_map dest \<noteq> mdbNext src_node; cte_map dest \<noteq> cte_map src; c' = cap; (aa, bb) = dest\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 7. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap node ab bc. \<lbrakk>(aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; cte_map (aa, bb) \<noteq> mdbNext src_node; cte_map (aa, bb) \<noteq> cte_map src; cte_map (aa, bb) \<noteq> cte_map dest; ctes_of b (cte_map (aa, bb)) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc) proof (prove)
goal (1 subgoal):
 1. \<And>src_cap a b ba s'' s''a s''b t src_cap' src_node dest_node aa bb cap node ab bc. \<lbrakk>(aa, bb) \<noteq> src; (aa, bb) \<noteq> dest; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) a; no_mloop (cdt a); finite_depth (cdt a); cap_relation c c'; src' = cte_map src; dest' = cte_map dest; cap_relation src_cap src_cap'; mdbPrev dest_node = 0; mdbNext dest_node = 0; ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; domain_list a = ksDomSchedule b; valid_objs a; pspace_distinct a; pspace_aligned a; valid_mdb a; valid_list a; src \<noteq> dest; cte_wp_at (\<lambda>c. c = cap.NullCap) dest a; is_simple_cap c; cte_wp_at (\<lambda>_. True) dest a; cte_wp_at (safe_parent_for (cdt a) src c) src a; cte_wp_at ((=) (masked_as_full src_cap c)) src a; pspace_distinct' b; pspace_aligned' b; valid_dlist (ctes_of b); no_0 (ctes_of b); mdb_chain_0 (ctes_of b); valid_badges (ctes_of b); caps_contained' (ctes_of b); mdb_chunked (ctes_of b); untyped_mdb' (ctes_of b); untyped_inc' (ctes_of b); valid_nullcaps (ctes_of b); ut_revocable' (ctes_of b); class_links (ctes_of b); distinct_zombies (ctes_of b); irq_control (ctes_of b); reply_masters_rvk_fb (ctes_of b); valid_cap' c' b; is_simple_cap' c'; ctes_of b (cte_map dest) = Some (CTE capability.NullCap dest_node); ctes_of b (cte_map src) = Some (CTE (maskedAsFull src_cap' c') src_node); safe_parent_for' (ctes_of b) (cte_map src) c'; ((), t) \<in> fst (set_cap c dest a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; is_original_cap t = is_original_cap a; (arch_state t, ksArchState b) \<in> arch_state_relation; domain_list t = ksDomSchedule s''; mdb_insert_abs (cdt a) src dest; pspace_aligned' s''; pspace_distinct' s''; pspace_aligned' s''a; pspace_distinct' s''a; pspace_aligned' s''b; pspace_distinct' s''b; pspace_aligned' ba; pspace_distinct' ba; cte_map dest \<noteq> 0; cte_map src \<noteq> 0; should_be_parent_of src_cap (is_original_cap a src) c (revokable src_cap c); cte_wp_at (\<lambda>_. True) src a; safe_parent_for (cdt a) src c src_cap; mdb_insert (ctes_of b) (cte_map src) (maskedAsFull src_cap' c') src_node (cte_map dest) capability.NullCap dest_node; cte_map (aa, bb) \<noteq> mdbNext src_node; cte_map (aa, bb) \<noteq> cte_map src; cte_map (aa, bb) \<noteq> cte_map dest; ctes_of b (cte_map (aa, bb)) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)