theory Deterministic_AI

lemma cap_insert_valid_list [wp]:
  notes split_paired_All[simp del] split_paired_Ex[simp del]
  shows
  "\<lbrace>valid_list\<rbrace>
    cap_insert cap src dest
   \<lbrace>\<lambda>_ s. valid_list s\<rbrace>" apply (simp add: cap_insert_def) apply(simp add: set_untyped_cap_as_full_def update_cdt_def set_cdt_def update_cdt_list_def set_cdt_list_def bind_assoc cap_insert_ext_def) apply (rule hoare_pre) apply (wp | simp cong: option.case_cong if_cong del: fun_upd_apply split del: if_split)+ apply(wp set_cap_caps_of_state3)[1] apply (case_tac "is_untyped_cap src_cap \<and>
         is_untyped_cap cap \<and>
         obj_ref_of src_cap = obj_ref_of cap \<and>
         cap_bits_untyped src_cap = cap_bits_untyped cap") apply (simp del: fun_upd_apply split del: if_split) apply (wp set_cap_caps_of_state3) apply (simp only:) apply (simp del: fun_upd_apply split del: if_split) apply (wp get_cap_wp)+ apply(intro allI impI conjI) apply (case_tac "src = dest") apply (simp add: cte_wp_at_caps_of_state fun_upd_idem del: fun_upd_apply) apply (case_tac "cdt s dest") apply (simp del: fun_upd_apply split del: if_split  cong: option.case_cong) apply (simp add: del: fun_upd_apply split del: if_split  cong: option.case_cong) apply (fastforce simp add: valid_list_2_def list_remove_removed list_remove_distinct) apply (case_tac "cdt s dest") apply (subgoal_tac "mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest") prefer 2 apply (rule mdb_insert_abs_simple_no_parent.intro[OF mdb_insert_abs_simple.intro]) apply simp apply (rule mdb_insert_abs_simple_no_parent_axioms.intro) apply simp apply (subgoal_tac "mdb_insert_abs_sib_simple_no_parent (cdt s) (cdt_list s) dest src") prefer 2 apply (rule mdb_insert_abs_sib_simple_no_parent.intro,assumption) apply (rule mdb_insert_abs_sib_simple_no_parent_axioms.intro,simp) apply(case_tac"should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)") apply (case_tac "cdt s src") apply (simp del: fun_upd_apply) apply (rule mdb_insert_abs_simple_no_parent.valid_list_post,simp) apply (case_tac "a = src") apply (simp del: fun_upd_apply) apply (subst self_parent_eq,assumption) apply (rule mdb_insert_abs_sib_simple_no_parent.valid_list_post,simp,simp) apply (simp add: fun_upd_twist del: fun_upd_apply) apply (rule mdb_insert_abs_simple_no_parent.valid_list_post,simp) apply (case_tac "cdt s src") apply (frule(1) mdb_insert_abs_sib_simple_no_parent.valid_list_post_no_parent) apply (simp del: fun_upd_apply) apply (simp del: fun_upd_apply) apply (frule(1) mdb_insert_abs_sib_simple_no_parent.valid_list_post) apply (simp del: fun_upd_apply) apply (subgoal_tac "mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a") prefer 2 apply (rule mdb_insert_abs_simple_parent.intro[OF mdb_insert_abs_simple.intro]) apply simp apply (rule mdb_insert_abs_simple_parent_axioms.intro) apply simp apply (subgoal_tac "mdb_insert_abs_sib_simple_parent (cdt s) (cdt_list s) dest a src") prefer 2 apply (rule mdb_insert_abs_sib_simple_parent.intro,assumption) apply (rule mdb_insert_abs_sib_simple_parent_axioms.intro,simp) apply(case_tac"should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)") apply (case_tac "cdt s src") apply (simp del: fun_upd_apply) apply (rule mdb_insert_abs_simple_parent.valid_list_post,simp) apply (case_tac "aa = src") apply (simp del: fun_upd_apply) apply (subst self_parent_eq,assumption) apply (rule mdb_insert_abs_sib_simple_parent.valid_list_post,simp,simp) apply (simp add: fun_upd_twist del: fun_upd_apply) apply (rule mdb_insert_abs_simple_parent.valid_list_post,simp) apply (case_tac "cdt s src") apply (frule(1) mdb_insert_abs_sib_simple_parent.valid_list_post_no_parent) apply (simp del: fun_upd_apply) apply (simp del: fun_upd_apply) apply (frule(1) mdb_insert_abs_sib_simple_parent.valid_list_post) apply (simp del: fun_upd_apply) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>valid_list\<rbrace> cap_insert cap src dest \<lbrace>\<lambda>_. valid_list\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>valid_list\<rbrace> do src_cap <- get_cap src;
old_cap <- get_cap dest;
y <- assert (old_cap = NullCap);
y <- set_untyped_cap_as_full src_cap cap src;
y <- set_cap cap dest;
is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
y <- update_cdt (\<lambda>cdt. cdt(dest := if should_be_parent_of src_cap (is_original src) cap (is_cap_revocable cap src_cap) then Some src else cdt src));
y <- cap_insert_ext (should_be_parent_of src_cap (is_original src) cap (is_cap_revocable cap src_cap)) src dest src_p dest_p;
set_original dest (is_cap_revocable cap src_cap)
od \<lbrace>\<lambda>_. valid_list\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>valid_list\<rbrace> do src_cap <- get_cap src;
old_cap <- get_cap dest;
y <- assert (old_cap = NullCap);
y <- if is_untyped_cap src_cap \<and> is_untyped_cap cap \<and> obj_ref_of src_cap = obj_ref_of cap \<and> cap_bits_untyped src_cap = cap_bits_untyped cap then set_cap (max_free_index_update src_cap) src else return ();
y <- set_cap cap dest;
is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
x <- gets cdt;
xa <- get;
y <- put (xa\<lparr>cdt := x(dest := if should_be_parent_of src_cap (is_original src) cap (is_cap_revocable cap src_cap) then Some src else x src)\<rparr>);
x <- gets cdt_list;
xa <- get;
x <- put (cdt_list_update (\<lambda>_. case dest_p of None \<Rightarrow> x | Some p \<Rightarrow> x(p := list_remove (x p) dest)) xa);
x <- gets cdt_list;
xa <- get;
y <- put (cdt_list_update (\<lambda>_. case src_p of None \<Rightarrow> x(src := if should_be_parent_of src_cap (is_original src) cap (is_cap_revocable cap src_cap) then dest # x src else x src) | Some p \<Rightarrow> x(src := if should_be_parent_of src_cap (is_original src) cap (is_cap_revocable cap src_cap) then dest # x src else x src, p := if should_be_parent_of src_cap (is_original src) cap (is_cap_revocable cap src_cap) \<and> p \<noteq> src then x p else if src \<noteq> dest then list_insert_after (x p) src dest else dest # x p)) xa);
set_original dest (is_cap_revocable cap src_cap)
od \<lbrace>\<lambda>_. valid_list\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<lbrace>?Q7\<rbrace> do src_cap <- get_cap src;
old_cap <- get_cap dest;
y <- assert (old_cap = NullCap);
y <- if is_untyped_cap src_cap \<and> is_untyped_cap cap \<and> obj_ref_of src_cap = obj_ref_of cap \<and> cap_bits_untyped src_cap = cap_bits_untyped cap then set_cap (max_free_index_update src_cap) src else return ();
y <- set_cap cap dest;
is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
x <- gets cdt;
xa <- get;
y <- put (xa\<lparr>cdt := x(dest := if should_be_parent_of src_cap (is_original src) cap (is_cap_revocable cap src_cap) then Some src else x src)\<rparr>);
x <- gets cdt_list;
xa <- get;
x <- put (cdt_list_update (\<lambda>_. case dest_p of None \<Rightarrow> x | Some p \<Rightarrow> x(p := list_remove (x p) dest)) xa);
x <- gets cdt_list;
xa <- get;
y <- put (cdt_list_update (\<lambda>_. case src_p of None \<Rightarrow> x(src := if should_be_parent_of src_cap (is_original src) cap (is_cap_revocable cap src_cap) then dest # x src else x src) | Some p \<Rightarrow> x(src := if should_be_parent_of src_cap (is_original src) cap (is_cap_revocable cap src_cap) then dest # x src else x src, p := if should_be_parent_of src_cap (is_original src) cap (is_cap_revocable cap src_cap) \<and> p \<noteq> src then x p else if src \<noteq> dest then list_insert_after (x p) src dest else dest # x p)) xa);
set_original dest (is_cap_revocable cap src_cap)
od \<lbrace>\<lambda>_. valid_list\<rbrace>
 2. \<And>s. valid_list s \<Longrightarrow> ?Q7 s proof (prove)
goal (6 subgoals):
 1. \<And>src_cap x. \<lbrace>?B14 src_cap x () ()\<rbrace> set_cap cap dest \<lbrace>\<lambda>yb s. valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of src_cap (is_original_cap s src) cap (is_cap_revocable cap src_cap) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of src_cap (is_original_cap s src) cap (is_cap_revocable cap src_cap) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of src_cap (is_original_cap s src) cap (is_cap_revocable cap src_cap) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of src_cap (is_original_cap s src) cap (is_cap_revocable cap src_cap) then Some src else cdt s src))\<rbrace>
 2. \<And>src_cap x y. \<lbrace>?B13 src_cap x y\<rbrace> if is_untyped_cap src_cap \<and> is_untyped_cap cap \<and> obj_ref_of src_cap = obj_ref_of cap \<and> cap_bits_untyped src_cap = cap_bits_untyped cap then set_cap (max_free_index_update src_cap) src else return () \<lbrace>?B14 src_cap x y\<rbrace>
 3. \<And>src_cap x. \<lbrace>?B12 src_cap x\<rbrace> assert (x = NullCap) \<lbrace>?B13 src_cap x\<rbrace>
 4. \<And>src_cap. \<lbrace>?B11 src_cap\<rbrace> get_cap dest \<lbrace>?B12 src_cap\<rbrace>
 5. \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>?B11\<rbrace>
 6. \<And>s. valid_list s \<Longrightarrow> ?Q7 s proof (prove)
goal (5 subgoals):
 1. \<And>src_cap x y. \<lbrace>?B13 src_cap x y\<rbrace> if is_untyped_cap src_cap \<and> is_untyped_cap cap \<and> obj_ref_of src_cap = obj_ref_of cap \<and> cap_bits_untyped src_cap = cap_bits_untyped cap then set_cap (max_free_index_update src_cap) src else return () \<lbrace>\<lambda>a b. valid_list_2 (case cdt b src of None \<Rightarrow> (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest))(src := if should_be_parent_of src_cap (is_original_cap b src) cap (is_cap_revocable cap src_cap) then dest # (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) src else (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) src) | Some p \<Rightarrow> (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest))(src := if should_be_parent_of src_cap (is_original_cap b src) cap (is_cap_revocable cap src_cap) then dest # (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) src else (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) src, p := if should_be_parent_of src_cap (is_original_cap b src) cap (is_cap_revocable cap src_cap) \<and> p \<noteq> src then (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) p) src dest else dest # (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) p)) ((cdt b)(dest := if should_be_parent_of src_cap (is_original_cap b src) cap (is_cap_revocable cap src_cap) then Some src else cdt b src))\<rbrace>
 2. \<And>src_cap x. \<lbrace>?B12 src_cap x\<rbrace> assert (x = NullCap) \<lbrace>?B13 src_cap x\<rbrace>
 3. \<And>src_cap. \<lbrace>?B11 src_cap\<rbrace> get_cap dest \<lbrace>?B12 src_cap\<rbrace>
 4. \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>?B11\<rbrace>
 5. \<And>s. valid_list s \<Longrightarrow> ?Q7 s proof (prove)
goal (6 subgoals):
 1. \<And>src_cap x y. is_untyped_cap src_cap \<and> is_untyped_cap cap \<and> obj_ref_of src_cap = obj_ref_of cap \<and> cap_bits_untyped src_cap = cap_bits_untyped cap \<Longrightarrow> \<lbrace>?B13 src_cap x y\<rbrace> if is_untyped_cap src_cap \<and> is_untyped_cap cap \<and> obj_ref_of src_cap = obj_ref_of cap \<and> cap_bits_untyped src_cap = cap_bits_untyped cap then set_cap (max_free_index_update src_cap) src else return () \<lbrace>\<lambda>a b. valid_list_2 (case cdt b src of None \<Rightarrow> (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest))(src := if should_be_parent_of src_cap (is_original_cap b src) cap (is_cap_revocable cap src_cap) then dest # (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) src else (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) src) | Some p \<Rightarrow> (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest))(src := if should_be_parent_of src_cap (is_original_cap b src) cap (is_cap_revocable cap src_cap) then dest # (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) src else (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) src, p := if should_be_parent_of src_cap (is_original_cap b src) cap (is_cap_revocable cap src_cap) \<and> p \<noteq> src then (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) p) src dest else dest # (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) p)) ((cdt b)(dest := if should_be_parent_of src_cap (is_original_cap b src) cap (is_cap_revocable cap src_cap) then Some src else cdt b src))\<rbrace>
 2. \<And>src_cap x y. \<not> (is_untyped_cap src_cap \<and> is_untyped_cap cap \<and> obj_ref_of src_cap = obj_ref_of cap \<and> cap_bits_untyped src_cap = cap_bits_untyped cap) \<Longrightarrow> \<lbrace>?B13 src_cap x y\<rbrace> if is_untyped_cap src_cap \<and> is_untyped_cap cap \<and> obj_ref_of src_cap = obj_ref_of cap \<and> cap_bits_untyped src_cap = cap_bits_untyped cap then set_cap (max_free_index_update src_cap) src else return () \<lbrace>\<lambda>a b. valid_list_2 (case cdt b src of None \<Rightarrow> (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest))(src := if should_be_parent_of src_cap (is_original_cap b src) cap (is_cap_revocable cap src_cap) then dest # (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) src else (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) src) | Some p \<Rightarrow> (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest))(src := if should_be_parent_of src_cap (is_original_cap b src) cap (is_cap_revocable cap src_cap) then dest # (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) src else (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) src, p := if should_be_parent_of src_cap (is_original_cap b src) cap (is_cap_revocable cap src_cap) \<and> p \<noteq> src then (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) p) src dest else dest # (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) p)) ((cdt b)(dest := if should_be_parent_of src_cap (is_original_cap b src) cap (is_cap_revocable cap src_cap) then Some src else cdt b src))\<rbrace>
 3. \<And>src_cap x. \<lbrace>?B12 src_cap x\<rbrace> assert (x = NullCap) \<lbrace>?B13 src_cap x\<rbrace>
 4. \<And>src_cap. \<lbrace>?B11 src_cap\<rbrace> get_cap dest \<lbrace>?B12 src_cap\<rbrace>
 5. \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>?B11\<rbrace>
 6. \<And>s. valid_list s \<Longrightarrow> ?Q7 s proof (prove)
goal (6 subgoals):
 1. \<And>src_cap x. is_untyped_cap src_cap \<and> is_untyped_cap cap \<and> obj_ref_of src_cap = obj_ref_of cap \<and> cap_bits_untyped src_cap = cap_bits_untyped cap \<Longrightarrow> \<lbrace>?B13 src_cap x ()\<rbrace> set_cap (max_free_index_update src_cap) src \<lbrace>\<lambda>a b. valid_list_2 (case cdt b src of None \<Rightarrow> (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest))(src := if should_be_parent_of src_cap (is_original_cap b src) cap (is_cap_revocable cap src_cap) then dest # (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) src else (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) src) | Some p \<Rightarrow> (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest))(src := if should_be_parent_of src_cap (is_original_cap b src) cap (is_cap_revocable cap src_cap) then dest # (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) src else (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) src, p := if should_be_parent_of src_cap (is_original_cap b src) cap (is_cap_revocable cap src_cap) \<and> p \<noteq> src then (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) p) src dest else dest # (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) p)) ((cdt b)(dest := if should_be_parent_of src_cap (is_original_cap b src) cap (is_cap_revocable cap src_cap) then Some src else cdt b src))\<rbrace>
 2. \<And>src_cap x y. \<not> (is_untyped_cap src_cap \<and> is_untyped_cap cap \<and> obj_ref_of src_cap = obj_ref_of cap \<and> cap_bits_untyped src_cap = cap_bits_untyped cap) \<Longrightarrow> \<lbrace>?B13 src_cap x y\<rbrace> if is_untyped_cap src_cap \<and> is_untyped_cap cap \<and> obj_ref_of src_cap = obj_ref_of cap \<and> cap_bits_untyped src_cap = cap_bits_untyped cap then set_cap (max_free_index_update src_cap) src else return () \<lbrace>\<lambda>a b. valid_list_2 (case cdt b src of None \<Rightarrow> (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest))(src := if should_be_parent_of src_cap (is_original_cap b src) cap (is_cap_revocable cap src_cap) then dest # (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) src else (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) src) | Some p \<Rightarrow> (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest))(src := if should_be_parent_of src_cap (is_original_cap b src) cap (is_cap_revocable cap src_cap) then dest # (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) src else (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) src, p := if should_be_parent_of src_cap (is_original_cap b src) cap (is_cap_revocable cap src_cap) \<and> p \<noteq> src then (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) p) src dest else dest # (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) p)) ((cdt b)(dest := if should_be_parent_of src_cap (is_original_cap b src) cap (is_cap_revocable cap src_cap) then Some src else cdt b src))\<rbrace>
 3. \<And>src_cap x. \<lbrace>?B12 src_cap x\<rbrace> assert (x = NullCap) \<lbrace>?B13 src_cap x\<rbrace>
 4. \<And>src_cap. \<lbrace>?B11 src_cap\<rbrace> get_cap dest \<lbrace>?B12 src_cap\<rbrace>
 5. \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>?B11\<rbrace>
 6. \<And>s. valid_list s \<Longrightarrow> ?Q7 s proof (prove)
goal (5 subgoals):
 1. \<And>src_cap x y. \<not> (is_untyped_cap src_cap \<and> is_untyped_cap cap \<and> obj_ref_of src_cap = obj_ref_of cap \<and> cap_bits_untyped src_cap = cap_bits_untyped cap) \<Longrightarrow> \<lbrace>\<lambda>a. valid_list_2 (case cdt a src of None \<Rightarrow> (case cdt a dest of None \<Rightarrow> cdt_list a | Some p \<Rightarrow> (cdt_list a)(p := list_remove (cdt_list a p) dest))(src := if should_be_parent_of src_cap (is_original_cap a src) cap (is_cap_revocable cap src_cap) then dest # (case cdt a dest of None \<Rightarrow> cdt_list a | Some p \<Rightarrow> (cdt_list a)(p := list_remove (cdt_list a p) dest)) src else (case cdt a dest of None \<Rightarrow> cdt_list a | Some p \<Rightarrow> (cdt_list a)(p := list_remove (cdt_list a p) dest)) src) | Some p \<Rightarrow> (case cdt a dest of None \<Rightarrow> cdt_list a | Some p \<Rightarrow> (cdt_list a)(p := list_remove (cdt_list a p) dest))(src := if should_be_parent_of src_cap (is_original_cap a src) cap (is_cap_revocable cap src_cap) then dest # (case cdt a dest of None \<Rightarrow> cdt_list a | Some p \<Rightarrow> (cdt_list a)(p := list_remove (cdt_list a p) dest)) src else (case cdt a dest of None \<Rightarrow> cdt_list a | Some p \<Rightarrow> (cdt_list a)(p := list_remove (cdt_list a p) dest)) src, p := if should_be_parent_of src_cap (is_original_cap a src) cap (is_cap_revocable cap src_cap) \<and> p \<noteq> src then (case cdt a dest of None \<Rightarrow> cdt_list a | Some p \<Rightarrow> (cdt_list a)(p := list_remove (cdt_list a p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt a dest of None \<Rightarrow> cdt_list a | Some p \<Rightarrow> (cdt_list a)(p := list_remove (cdt_list a p) dest)) p) src dest else dest # (case cdt a dest of None \<Rightarrow> cdt_list a | Some p \<Rightarrow> (cdt_list a)(p := list_remove (cdt_list a p) dest)) p)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) cap (is_cap_revocable cap src_cap) then Some src else cdt a src))\<rbrace> if is_untyped_cap src_cap \<and> is_untyped_cap cap \<and> obj_ref_of src_cap = obj_ref_of cap \<and> cap_bits_untyped src_cap = cap_bits_untyped cap then set_cap (max_free_index_update src_cap) src else return () \<lbrace>\<lambda>a b. valid_list_2 (case cdt b src of None \<Rightarrow> (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest))(src := if should_be_parent_of src_cap (is_original_cap b src) cap (is_cap_revocable cap src_cap) then dest # (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) src else (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) src) | Some p \<Rightarrow> (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest))(src := if should_be_parent_of src_cap (is_original_cap b src) cap (is_cap_revocable cap src_cap) then dest # (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) src else (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) src, p := if should_be_parent_of src_cap (is_original_cap b src) cap (is_cap_revocable cap src_cap) \<and> p \<noteq> src then (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) p) src dest else dest # (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) p)) ((cdt b)(dest := if should_be_parent_of src_cap (is_original_cap b src) cap (is_cap_revocable cap src_cap) then Some src else cdt b src))\<rbrace>
 2. \<And>src_cap x. \<lbrace>?B12 src_cap x\<rbrace> assert (x = NullCap) \<lbrace>\<lambda>a b. valid_list_2 (case cdt b src of None \<Rightarrow> (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest))(src := if should_be_parent_of src_cap (is_original_cap b src) cap (is_cap_revocable cap src_cap) then dest # (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) src else (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) src) | Some p \<Rightarrow> (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest))(src := if should_be_parent_of src_cap (is_original_cap b src) cap (is_cap_revocable cap src_cap) then dest # (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) src else (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) src, p := if should_be_parent_of src_cap (is_original_cap b src) cap (is_cap_revocable cap src_cap) \<and> p \<noteq> src then (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) p) src dest else dest # (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) p)) ((cdt b)(dest := if should_be_parent_of src_cap (is_original_cap b src) cap (is_cap_revocable cap src_cap) then Some src else cdt b src))\<rbrace>
 3. \<And>src_cap. \<lbrace>?B11 src_cap\<rbrace> get_cap dest \<lbrace>?B12 src_cap\<rbrace>
 4. \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>?B11\<rbrace>
 5. \<And>s. valid_list s \<Longrightarrow> ?Q7 s proof (prove)
goal (5 subgoals):
 1. \<And>src_cap x y. \<not> (is_untyped_cap src_cap \<and> is_untyped_cap cap \<and> obj_ref_of src_cap = obj_ref_of cap \<and> cap_bits_untyped src_cap = cap_bits_untyped cap) \<Longrightarrow> \<lbrace>\<lambda>a. valid_list_2 (case cdt a src of None \<Rightarrow> (case cdt a dest of None \<Rightarrow> cdt_list a | Some p \<Rightarrow> (cdt_list a)(p := list_remove (cdt_list a p) dest))(src := if should_be_parent_of src_cap (is_original_cap a src) cap (is_cap_revocable cap src_cap) then dest # (case cdt a dest of None \<Rightarrow> cdt_list a | Some p \<Rightarrow> (cdt_list a)(p := list_remove (cdt_list a p) dest)) src else (case cdt a dest of None \<Rightarrow> cdt_list a | Some p \<Rightarrow> (cdt_list a)(p := list_remove (cdt_list a p) dest)) src) | Some p \<Rightarrow> (case cdt a dest of None \<Rightarrow> cdt_list a | Some p \<Rightarrow> (cdt_list a)(p := list_remove (cdt_list a p) dest))(src := if should_be_parent_of src_cap (is_original_cap a src) cap (is_cap_revocable cap src_cap) then dest # (case cdt a dest of None \<Rightarrow> cdt_list a | Some p \<Rightarrow> (cdt_list a)(p := list_remove (cdt_list a p) dest)) src else (case cdt a dest of None \<Rightarrow> cdt_list a | Some p \<Rightarrow> (cdt_list a)(p := list_remove (cdt_list a p) dest)) src, p := if should_be_parent_of src_cap (is_original_cap a src) cap (is_cap_revocable cap src_cap) \<and> p \<noteq> src then (case cdt a dest of None \<Rightarrow> cdt_list a | Some p \<Rightarrow> (cdt_list a)(p := list_remove (cdt_list a p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt a dest of None \<Rightarrow> cdt_list a | Some p \<Rightarrow> (cdt_list a)(p := list_remove (cdt_list a p) dest)) p) src dest else dest # (case cdt a dest of None \<Rightarrow> cdt_list a | Some p \<Rightarrow> (cdt_list a)(p := list_remove (cdt_list a p) dest)) p)) ((cdt a)(dest := if should_be_parent_of src_cap (is_original_cap a src) cap (is_cap_revocable cap src_cap) then Some src else cdt a src))\<rbrace> if False then set_cap (max_free_index_update src_cap) src else return () \<lbrace>\<lambda>a b. valid_list_2 (case cdt b src of None \<Rightarrow> (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest))(src := if should_be_parent_of src_cap (is_original_cap b src) cap (is_cap_revocable cap src_cap) then dest # (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) src else (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) src) | Some p \<Rightarrow> (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest))(src := if should_be_parent_of src_cap (is_original_cap b src) cap (is_cap_revocable cap src_cap) then dest # (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) src else (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) src, p := if should_be_parent_of src_cap (is_original_cap b src) cap (is_cap_revocable cap src_cap) \<and> p \<noteq> src then (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) p) src dest else dest # (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) p)) ((cdt b)(dest := if should_be_parent_of src_cap (is_original_cap b src) cap (is_cap_revocable cap src_cap) then Some src else cdt b src))\<rbrace>
 2. \<And>src_cap x. \<lbrace>?B12 src_cap x\<rbrace> assert (x = NullCap) \<lbrace>\<lambda>a b. valid_list_2 (case cdt b src of None \<Rightarrow> (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest))(src := if should_be_parent_of src_cap (is_original_cap b src) cap (is_cap_revocable cap src_cap) then dest # (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) src else (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) src) | Some p \<Rightarrow> (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest))(src := if should_be_parent_of src_cap (is_original_cap b src) cap (is_cap_revocable cap src_cap) then dest # (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) src else (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) src, p := if should_be_parent_of src_cap (is_original_cap b src) cap (is_cap_revocable cap src_cap) \<and> p \<noteq> src then (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) p) src dest else dest # (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) p)) ((cdt b)(dest := if should_be_parent_of src_cap (is_original_cap b src) cap (is_cap_revocable cap src_cap) then Some src else cdt b src))\<rbrace>
 3. \<And>src_cap. \<lbrace>?B11 src_cap\<rbrace> get_cap dest \<lbrace>?B12 src_cap\<rbrace>
 4. \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>?B11\<rbrace>
 5. \<And>s. valid_list s \<Longrightarrow> ?Q7 s proof (prove)
goal (4 subgoals):
 1. \<And>src_cap x. \<lbrace>?B12 src_cap x\<rbrace> assert (x = NullCap) \<lbrace>\<lambda>a b. valid_list_2 (case cdt b src of None \<Rightarrow> (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest))(src := if should_be_parent_of src_cap (is_original_cap b src) cap (is_cap_revocable cap src_cap) then dest # (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) src else (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) src) | Some p \<Rightarrow> (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest))(src := if should_be_parent_of src_cap (is_original_cap b src) cap (is_cap_revocable cap src_cap) then dest # (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) src else (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) src, p := if should_be_parent_of src_cap (is_original_cap b src) cap (is_cap_revocable cap src_cap) \<and> p \<noteq> src then (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) p) src dest else dest # (case cdt b dest of None \<Rightarrow> cdt_list b | Some p \<Rightarrow> (cdt_list b)(p := list_remove (cdt_list b p) dest)) p)) ((cdt b)(dest := if should_be_parent_of src_cap (is_original_cap b src) cap (is_cap_revocable cap src_cap) then Some src else cdt b src))\<rbrace>
 2. \<And>src_cap. \<lbrace>?B11 src_cap\<rbrace> get_cap dest \<lbrace>?B12 src_cap\<rbrace>
 3. \<lbrace>?Q7\<rbrace> get_cap src \<lbrace>?B11\<rbrace>
 4. \<And>s. valid_list s \<Longrightarrow> ?Q7 s proof (prove)
goal (1 subgoal):
 1. \<And>s. valid_list s \<Longrightarrow> \<forall>capa. cte_wp_at ((=) capa) src s \<longrightarrow> (\<forall>capb. cte_wp_at ((=) capb) dest s \<longrightarrow> capb = NullCap \<longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))) proof (prove)
goal (1 subgoal):
 1. \<And>s capa capaa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa capaa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src = dest\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 2. \<And>s capa capaa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (2 subgoals):
 1. \<And>s cap capa. \<lbrakk>valid_list s; caps_of_state s dest = Some NullCap; NullCap = cap; capa = NullCap; src = dest\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := dest # ((cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) (cdt s)
 2. \<And>s capa capaa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (3 subgoals):
 1. \<And>s cap capa. \<lbrakk>valid_list s; caps_of_state s dest = Some NullCap; NullCap = cap; capa = NullCap; src = dest; cdt s dest = None\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := dest # ((cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) (cdt s)
 2. \<And>s cap capa a. \<lbrakk>valid_list s; caps_of_state s dest = Some NullCap; NullCap = cap; capa = NullCap; src = dest; cdt s dest = Some a\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := dest # ((cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) (cdt s)
 3. \<And>s capa capaa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (2 subgoals):
 1. \<And>s cap capa a. \<lbrakk>valid_list s; caps_of_state s dest = Some NullCap; NullCap = cap; capa = NullCap; src = dest; cdt s dest = Some a\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := dest # ((cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) (cdt s)
 2. \<And>s capa capaa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (2 subgoals):
 1. \<And>s cap capa a. \<lbrakk>valid_list s; caps_of_state s dest = Some NullCap; NullCap = cap; capa = NullCap; src = dest; cdt s dest = Some a\<rbrakk> \<Longrightarrow> valid_list_2 ((cdt_list s)(a := dest # ((cdt_list s)(a := list_remove (cdt_list s a) dest)) a)) (cdt s)
 2. \<And>s capa capaa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (1 subgoal):
 1. \<And>s capa capaa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa capaa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 2. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (3 subgoals):
 1. \<And>s capa capaa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 2. \<And>s cap capa. \<lbrakk>valid_list s; cte_wp_at ((=) cap) src s; cte_wp_at ((=) capa) dest s; capa = NullCap; src \<noteq> dest; cdt s dest = None\<rbrakk> \<Longrightarrow> mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest
 3. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (3 subgoals):
 1. \<And>s cap capa. \<lbrakk>valid_list s; cte_wp_at ((=) cap) src s; cte_wp_at ((=) capa) dest s; capa = NullCap; src \<noteq> dest; cdt s dest = None\<rbrakk> \<Longrightarrow> mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest
 2. \<And>s capa capaa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 3. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (4 subgoals):
 1. \<And>s cap capa. \<lbrakk>valid_list s; cte_wp_at ((=) cap) src s; cte_wp_at ((=) capa) dest s; capa = NullCap; src \<noteq> dest; cdt s dest = None\<rbrakk> \<Longrightarrow> valid_list s
 2. \<And>s cap capa. \<lbrakk>valid_list s; cte_wp_at ((=) cap) src s; cte_wp_at ((=) capa) dest s; capa = NullCap; src \<noteq> dest; cdt s dest = None\<rbrakk> \<Longrightarrow> mdb_insert_abs_simple_no_parent_axioms (cdt s) dest
 3. \<And>s capa capaa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 4. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (3 subgoals):
 1. \<And>s cap capa. \<lbrakk>valid_list s; cte_wp_at ((=) cap) src s; cte_wp_at ((=) capa) dest s; capa = NullCap; src \<noteq> dest; cdt s dest = None\<rbrakk> \<Longrightarrow> mdb_insert_abs_simple_no_parent_axioms (cdt s) dest
 2. \<And>s capa capaa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 3. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (3 subgoals):
 1. \<And>s cap capa. \<lbrakk>valid_list s; cte_wp_at ((=) cap) src s; cte_wp_at ((=) capa) dest s; capa = NullCap; src \<noteq> dest; cdt s dest = None\<rbrakk> \<Longrightarrow> cdt s dest = None
 2. \<And>s capa capaa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 3. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa capaa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 2. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (3 subgoals):
 1. \<And>s capa capaa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest; mdb_insert_abs_sib_simple_no_parent (cdt s) (cdt_list s) dest src\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 2. \<And>s cap capa. \<lbrakk>valid_list s; cte_wp_at ((=) cap) src s; cte_wp_at ((=) capa) dest s; capa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest\<rbrakk> \<Longrightarrow> mdb_insert_abs_sib_simple_no_parent (cdt s) (cdt_list s) dest src
 3. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (3 subgoals):
 1. \<And>s cap capa. \<lbrakk>valid_list s; cte_wp_at ((=) cap) src s; cte_wp_at ((=) capa) dest s; capa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest\<rbrakk> \<Longrightarrow> mdb_insert_abs_sib_simple_no_parent (cdt s) (cdt_list s) dest src
 2. \<And>s capa capaa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest; mdb_insert_abs_sib_simple_no_parent (cdt s) (cdt_list s) dest src\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 3. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (3 subgoals):
 1. \<And>s cap capa. \<lbrakk>valid_list s; cte_wp_at ((=) cap) src s; cte_wp_at ((=) capa) dest s; capa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest\<rbrakk> \<Longrightarrow> mdb_insert_abs_sib_simple_no_parent_axioms dest src
 2. \<And>s capa capaa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest; mdb_insert_abs_sib_simple_no_parent (cdt s) (cdt_list s) dest src\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 3. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa capaa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest; mdb_insert_abs_sib_simple_no_parent (cdt s) (cdt_list s) dest src\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 2. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (3 subgoals):
 1. \<And>s capa capaa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest; mdb_insert_abs_sib_simple_no_parent (cdt s) (cdt_list s) dest src; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 2. \<And>s capa capaa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest; mdb_insert_abs_sib_simple_no_parent (cdt s) (cdt_list s) dest src; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 3. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (4 subgoals):
 1. \<And>s capa capaa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest; mdb_insert_abs_sib_simple_no_parent (cdt s) (cdt_list s) dest src; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); cdt s src = None\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 2. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest; mdb_insert_abs_sib_simple_no_parent (cdt s) (cdt_list s) dest src; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); cdt s src = Some a\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 3. \<And>s capa capaa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest; mdb_insert_abs_sib_simple_no_parent (cdt s) (cdt_list s) dest src; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 4. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (4 subgoals):
 1. \<And>s capa capaa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest; mdb_insert_abs_sib_simple_no_parent (cdt s) (cdt_list s) dest src; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); cdt s src = None\<rbrakk> \<Longrightarrow> valid_list_2 ((cdt_list s)(src := dest # cdt_list s src)) ((cdt s)(dest \<mapsto> src))
 2. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest; mdb_insert_abs_sib_simple_no_parent (cdt s) (cdt_list s) dest src; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); cdt s src = Some a\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 3. \<And>s capa capaa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest; mdb_insert_abs_sib_simple_no_parent (cdt s) (cdt_list s) dest src; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 4. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (3 subgoals):
 1. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest; mdb_insert_abs_sib_simple_no_parent (cdt s) (cdt_list s) dest src; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); cdt s src = Some a\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 2. \<And>s capa capaa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest; mdb_insert_abs_sib_simple_no_parent (cdt s) (cdt_list s) dest src; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 3. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (4 subgoals):
 1. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest; mdb_insert_abs_sib_simple_no_parent (cdt s) (cdt_list s) dest src; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); cdt s src = Some a; a = src\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 2. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest; mdb_insert_abs_sib_simple_no_parent (cdt s) (cdt_list s) dest src; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); cdt s src = Some a; a \<noteq> src\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 3. \<And>s capa capaa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest; mdb_insert_abs_sib_simple_no_parent (cdt s) (cdt_list s) dest src; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 4. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (4 subgoals):
 1. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest; mdb_insert_abs_sib_simple_no_parent (cdt s) (cdt_list s) dest src; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); cdt s src = Some src; a = src\<rbrakk> \<Longrightarrow> valid_list_2 ((cdt_list s)(src := list_insert_after (cdt_list s src) src dest)) ((cdt s)(dest \<mapsto> src))
 2. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest; mdb_insert_abs_sib_simple_no_parent (cdt s) (cdt_list s) dest src; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); cdt s src = Some a; a \<noteq> src\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 3. \<And>s capa capaa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest; mdb_insert_abs_sib_simple_no_parent (cdt s) (cdt_list s) dest src; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 4. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (4 subgoals):
 1. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest; mdb_insert_abs_sib_simple_no_parent (cdt s) (cdt_list s) dest src; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); cdt s src = Some src; a = src\<rbrakk> \<Longrightarrow> valid_list_2 ((cdt_list s)(src := list_insert_after (cdt_list s src) src dest)) ((cdt s)(dest := cdt s src))
 2. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest; mdb_insert_abs_sib_simple_no_parent (cdt s) (cdt_list s) dest src; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); cdt s src = Some a; a \<noteq> src\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 3. \<And>s capa capaa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest; mdb_insert_abs_sib_simple_no_parent (cdt s) (cdt_list s) dest src; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 4. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (3 subgoals):
 1. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest; mdb_insert_abs_sib_simple_no_parent (cdt s) (cdt_list s) dest src; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); cdt s src = Some a; a \<noteq> src\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 2. \<And>s capa capaa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest; mdb_insert_abs_sib_simple_no_parent (cdt s) (cdt_list s) dest src; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 3. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (3 subgoals):
 1. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest; mdb_insert_abs_sib_simple_no_parent (cdt s) (cdt_list s) dest src; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); cdt s src = Some a; a \<noteq> src\<rbrakk> \<Longrightarrow> valid_list_2 ((cdt_list s)(src := dest # cdt_list s src)) ((cdt s)(dest \<mapsto> src))
 2. \<And>s capa capaa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest; mdb_insert_abs_sib_simple_no_parent (cdt s) (cdt_list s) dest src; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 3. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa capaa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest; mdb_insert_abs_sib_simple_no_parent (cdt s) (cdt_list s) dest src; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 2. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (3 subgoals):
 1. \<And>s capa capaa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest; mdb_insert_abs_sib_simple_no_parent (cdt s) (cdt_list s) dest src; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); cdt s src = None\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 2. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest; mdb_insert_abs_sib_simple_no_parent (cdt s) (cdt_list s) dest src; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); cdt s src = Some a\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 3. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (3 subgoals):
 1. \<And>s capa capaa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest; mdb_insert_abs_sib_simple_no_parent (cdt s) (cdt_list s) dest src; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); cdt s src = None; valid_list_2 (cdt_list s) ((cdt s)(dest := cdt s src))\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 2. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest; mdb_insert_abs_sib_simple_no_parent (cdt s) (cdt_list s) dest src; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); cdt s src = Some a\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 3. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest; mdb_insert_abs_sib_simple_no_parent (cdt s) (cdt_list s) dest src; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); cdt s src = Some a\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 2. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest; mdb_insert_abs_sib_simple_no_parent (cdt s) (cdt_list s) dest src; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); cdt s src = Some a\<rbrakk> \<Longrightarrow> valid_list_2 ((cdt_list s)(a := list_insert_after (cdt_list s a) src dest)) ((cdt s)(dest \<mapsto> a))
 2. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = None; mdb_insert_abs_simple_no_parent (cdt s) (cdt_list s) dest; mdb_insert_abs_sib_simple_no_parent (cdt s) (cdt_list s) dest src; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); cdt s src = Some a; valid_list_2 ((cdt_list s)(a := list_insert_after (cdt_list s a) src dest)) ((cdt s)(dest := cdt s src))\<rbrakk> \<Longrightarrow> valid_list_2 ((cdt_list s)(a := list_insert_after (cdt_list s a) src dest)) ((cdt s)(dest \<mapsto> a))
 2. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (1 subgoal):
 1. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 2. \<And>s cap capa a. \<lbrakk>valid_list s; cte_wp_at ((=) cap) src s; cte_wp_at ((=) capa) dest s; capa = NullCap; src \<noteq> dest; cdt s dest = Some a\<rbrakk> \<Longrightarrow> mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a proof (prove)
goal (2 subgoals):
 1. \<And>s cap capa a. \<lbrakk>valid_list s; cte_wp_at ((=) cap) src s; cte_wp_at ((=) capa) dest s; capa = NullCap; src \<noteq> dest; cdt s dest = Some a\<rbrakk> \<Longrightarrow> mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a
 2. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (3 subgoals):
 1. \<And>s cap capa a. \<lbrakk>valid_list s; cte_wp_at ((=) cap) src s; cte_wp_at ((=) capa) dest s; capa = NullCap; src \<noteq> dest; cdt s dest = Some a\<rbrakk> \<Longrightarrow> valid_list s
 2. \<And>s cap capa a. \<lbrakk>valid_list s; cte_wp_at ((=) cap) src s; cte_wp_at ((=) capa) dest s; capa = NullCap; src \<noteq> dest; cdt s dest = Some a\<rbrakk> \<Longrightarrow> mdb_insert_abs_simple_parent_axioms (cdt s) dest a
 3. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (2 subgoals):
 1. \<And>s cap capa a. \<lbrakk>valid_list s; cte_wp_at ((=) cap) src s; cte_wp_at ((=) capa) dest s; capa = NullCap; src \<noteq> dest; cdt s dest = Some a\<rbrakk> \<Longrightarrow> mdb_insert_abs_simple_parent_axioms (cdt s) dest a
 2. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (2 subgoals):
 1. \<And>s cap capa a. \<lbrakk>valid_list s; cte_wp_at ((=) cap) src s; cte_wp_at ((=) capa) dest s; capa = NullCap; src \<noteq> dest; cdt s dest = Some a\<rbrakk> \<Longrightarrow> cdt s dest = Some a
 2. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (1 subgoal):
 1. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a; mdb_insert_abs_sib_simple_parent (cdt s) (cdt_list s) dest a src\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 2. \<And>s cap capa a. \<lbrakk>valid_list s; cte_wp_at ((=) cap) src s; cte_wp_at ((=) capa) dest s; capa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a\<rbrakk> \<Longrightarrow> mdb_insert_abs_sib_simple_parent (cdt s) (cdt_list s) dest a src proof (prove)
goal (2 subgoals):
 1. \<And>s cap capa a. \<lbrakk>valid_list s; cte_wp_at ((=) cap) src s; cte_wp_at ((=) capa) dest s; capa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a\<rbrakk> \<Longrightarrow> mdb_insert_abs_sib_simple_parent (cdt s) (cdt_list s) dest a src
 2. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a; mdb_insert_abs_sib_simple_parent (cdt s) (cdt_list s) dest a src\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (2 subgoals):
 1. \<And>s cap capa a. \<lbrakk>valid_list s; cte_wp_at ((=) cap) src s; cte_wp_at ((=) capa) dest s; capa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a\<rbrakk> \<Longrightarrow> mdb_insert_abs_sib_simple_parent_axioms dest src
 2. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a; mdb_insert_abs_sib_simple_parent (cdt s) (cdt_list s) dest a src\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (1 subgoal):
 1. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a; mdb_insert_abs_sib_simple_parent (cdt s) (cdt_list s) dest a src\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a; mdb_insert_abs_sib_simple_parent (cdt s) (cdt_list s) dest a src; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 2. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a; mdb_insert_abs_sib_simple_parent (cdt s) (cdt_list s) dest a src; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (3 subgoals):
 1. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a; mdb_insert_abs_sib_simple_parent (cdt s) (cdt_list s) dest a src; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); cdt s src = None\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 2. \<And>s capa capaa a aa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a; mdb_insert_abs_sib_simple_parent (cdt s) (cdt_list s) dest a src; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); cdt s src = Some aa\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 3. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a; mdb_insert_abs_sib_simple_parent (cdt s) (cdt_list s) dest a src; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (3 subgoals):
 1. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a; mdb_insert_abs_sib_simple_parent (cdt s) (cdt_list s) dest a src; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); cdt s src = None\<rbrakk> \<Longrightarrow> valid_list_2 ((cdt_list s)(a := list_remove (cdt_list s a) dest, src := dest # ((cdt_list s)(a := list_remove (cdt_list s a) dest)) src)) ((cdt s)(dest \<mapsto> src))
 2. \<And>s capa capaa a aa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a; mdb_insert_abs_sib_simple_parent (cdt s) (cdt_list s) dest a src; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); cdt s src = Some aa\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 3. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a; mdb_insert_abs_sib_simple_parent (cdt s) (cdt_list s) dest a src; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa capaa a aa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a; mdb_insert_abs_sib_simple_parent (cdt s) (cdt_list s) dest a src; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); cdt s src = Some aa\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 2. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a; mdb_insert_abs_sib_simple_parent (cdt s) (cdt_list s) dest a src; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (3 subgoals):
 1. \<And>s capa capaa a aa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a; mdb_insert_abs_sib_simple_parent (cdt s) (cdt_list s) dest a src; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); cdt s src = Some aa; aa = src\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 2. \<And>s capa capaa a aa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a; mdb_insert_abs_sib_simple_parent (cdt s) (cdt_list s) dest a src; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); cdt s src = Some aa; aa \<noteq> src\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 3. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a; mdb_insert_abs_sib_simple_parent (cdt s) (cdt_list s) dest a src; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (3 subgoals):
 1. \<And>s capa capaa a aa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a; mdb_insert_abs_sib_simple_parent (cdt s) (cdt_list s) dest a src; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); cdt s src = Some src; aa = src\<rbrakk> \<Longrightarrow> valid_list_2 ((cdt_list s)(a := list_remove (cdt_list s a) dest, src := list_insert_after (((cdt_list s)(a := list_remove (cdt_list s a) dest)) src) src dest)) ((cdt s)(dest \<mapsto> src))
 2. \<And>s capa capaa a aa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a; mdb_insert_abs_sib_simple_parent (cdt s) (cdt_list s) dest a src; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); cdt s src = Some aa; aa \<noteq> src\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 3. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a; mdb_insert_abs_sib_simple_parent (cdt s) (cdt_list s) dest a src; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (3 subgoals):
 1. \<And>s capa capaa a aa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a; mdb_insert_abs_sib_simple_parent (cdt s) (cdt_list s) dest a src; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); cdt s src = Some src; aa = src\<rbrakk> \<Longrightarrow> valid_list_2 ((cdt_list s)(a := list_remove (cdt_list s a) dest, src := list_insert_after (((cdt_list s)(a := list_remove (cdt_list s a) dest)) src) src dest)) ((cdt s)(dest := cdt s src))
 2. \<And>s capa capaa a aa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a; mdb_insert_abs_sib_simple_parent (cdt s) (cdt_list s) dest a src; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); cdt s src = Some aa; aa \<noteq> src\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 3. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a; mdb_insert_abs_sib_simple_parent (cdt s) (cdt_list s) dest a src; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa capaa a aa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a; mdb_insert_abs_sib_simple_parent (cdt s) (cdt_list s) dest a src; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); cdt s src = Some aa; aa \<noteq> src\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 2. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a; mdb_insert_abs_sib_simple_parent (cdt s) (cdt_list s) dest a src; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa capaa a aa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a; mdb_insert_abs_sib_simple_parent (cdt s) (cdt_list s) dest a src; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); cdt s src = Some aa; aa \<noteq> src\<rbrakk> \<Longrightarrow> valid_list_2 ((cdt_list s)(a := list_remove (cdt_list s a) dest, src := dest # ((cdt_list s)(a := list_remove (cdt_list s a) dest)) src)) ((cdt s)(dest \<mapsto> src))
 2. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a; mdb_insert_abs_sib_simple_parent (cdt s) (cdt_list s) dest a src; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (1 subgoal):
 1. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a; mdb_insert_abs_sib_simple_parent (cdt s) (cdt_list s) dest a src; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a; mdb_insert_abs_sib_simple_parent (cdt s) (cdt_list s) dest a src; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); cdt s src = None\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 2. \<And>s capa capaa a aa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a; mdb_insert_abs_sib_simple_parent (cdt s) (cdt_list s) dest a src; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); cdt s src = Some aa\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa capaa a. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a; mdb_insert_abs_sib_simple_parent (cdt s) (cdt_list s) dest a src; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); cdt s src = None; valid_list_2 ((cdt_list s)(a := list_remove (cdt_list s a) dest)) ((cdt s)(dest := cdt s src))\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src))
 2. \<And>s capa capaa a aa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a; mdb_insert_abs_sib_simple_parent (cdt s) (cdt_list s) dest a src; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); cdt s src = Some aa\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (1 subgoal):
 1. \<And>s capa capaa a aa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) capaa) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a; mdb_insert_abs_sib_simple_parent (cdt s) (cdt_list s) dest a src; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); cdt s src = Some aa\<rbrakk> \<Longrightarrow> valid_list_2 (case cdt s src of None \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src) | Some p \<Rightarrow> (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest))(src := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src else (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) src, p := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) \<and> p \<noteq> src then (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p else if src \<noteq> dest then list_insert_after ((case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p) src dest else dest # (case cdt s dest of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) dest)) p)) ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) proof (prove)
goal (1 subgoal):
 1. \<And>s capa capaa a aa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a; mdb_insert_abs_sib_simple_parent (cdt s) (cdt_list s) dest a src; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); cdt s src = Some aa\<rbrakk> \<Longrightarrow> valid_list_2 ((cdt_list s)(a := list_remove (cdt_list s a) dest, aa := list_insert_after (((cdt_list s)(a := list_remove (cdt_list s a) dest)) aa) src dest)) ((cdt s)(dest \<mapsto> aa)) proof (prove)
goal (1 subgoal):
 1. \<And>s capa capaa a aa. \<lbrakk>valid_list s; cte_wp_at ((=) capa) src s; cte_wp_at ((=) NullCap) dest s; capaa = NullCap; src \<noteq> dest; cdt s dest = Some a; mdb_insert_abs_simple_parent (cdt s) (cdt_list s) dest a; mdb_insert_abs_sib_simple_parent (cdt s) (cdt_list s) dest a src; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); cdt s src = Some aa; valid_list_2 ((cdt_list s)(a := list_remove (cdt_list s a) dest, aa := list_insert_after (((cdt_list s)(a := list_remove (cdt_list s a) dest)) aa) src dest)) ((cdt s)(dest := cdt s src))\<rbrakk> \<Longrightarrow> valid_list_2 ((cdt_list s)(a := list_remove (cdt_list s a) dest, aa := list_insert_after (((cdt_list s)(a := list_remove (cdt_list s a) dest)) aa) src dest)) ((cdt s)(dest \<mapsto> aa)) proof (prove)
goal:
No subgoals!