theory Retype_R

lemma state_relation_null_filterE:
  "\<lbrakk> (s, s') \<in> state_relation; t = kheap_update f (ekheap_update ef s);
     \<exists>f' g' h'.
     t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'),
             gsCNodes := h' (gsCNodes s')\<rparr>;
     null_filter (caps_of_state t) = null_filter (caps_of_state s);
     null_filter' (ctes_of t') = null_filter' (ctes_of s');
     pspace_relation (kheap t) (ksPSpace t');
     ekheap_relation (ekheap t) (ksPSpace t');
     ghost_relation (kheap t) (gsUserPages t') (gsCNodes t'); valid_list s;
     pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s;
     pspace_aligned' t'; pspace_distinct' t';
     mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s) \<rbrakk>
      \<Longrightarrow> (t, t') \<in> state_relation" apply (clarsimp simp: state_relation_def) apply (intro conjI) apply (simp add: cdt_relation_def cte_wp_at_caps_of_state) apply (elim allEI) apply clarsimp apply (erule(1) across_null_filter_eq) apply simp apply (rule null_filter_descendants_of', simp) apply simp apply (case_tac "cdt s (a, b)") apply (subst mdb_cte_at_no_descendants, assumption) apply (simp add: cte_wp_at_caps_of_state swp_def) apply (cut_tac s="kheap_update f (ekheap_update ef s)"  and
                    s'="s'\<lparr>ksPSpace := f' (ksPSpace s'),
                           gsUserPages := g' (gsUserPages s'),
                           gsCNodes := h' (gsCNodes s')\<rparr>"
            in pspace_relation_ctes_ofI, simp_all)[1] apply (simp add: trans_state_update[symmetric] del: trans_state_update) apply (erule caps_of_state_cteD) apply (clarsimp simp: descendants_of'_def) apply (case_tac cte) apply (erule Null_not_subtree[rotated]) apply simp apply (drule(1) mdb_cte_atD) apply (clarsimp simp: cte_wp_at_caps_of_state) apply(simp add: cdt_list_relation_def cte_wp_at_caps_of_state) apply(elim allEI) apply(clarsimp) apply(case_tac "next_slot (a, b) (cdt_list (s)) (cdt s)") apply(simp) apply(subgoal_tac "cte_wp_at (\<lambda>c. c \<noteq> cap.NullCap) (a, b) s") apply(drule_tac f="\<lambda>cs. cs (a, b)" in arg_cong) apply(clarsimp simp: cte_wp_at_caps_of_state) apply(clarsimp simp: null_filter_def split: if_split_asm) apply(drule_tac f="\<lambda>ctes. ctes (cte_map (a, b))" in arg_cong) apply(simp add: null_filter'_def cte_wp_at_ctes_of split: if_split_asm) apply(frule pspace_relation_cte_wp_at) apply(simp add: cte_wp_at_caps_of_state) apply(simp) apply(simp) apply(simp add: cte_wp_at_ctes_of) apply (simp add: mdb_cte_at_def) apply(frule finite_depth) apply(frule(3) cte_at_next_slot'') apply simp apply (simp add: revokable_relation_def) apply (elim allEI, rule impI, drule(1) mp, elim allEI) apply (clarsimp elim!: null_filterE) apply (drule(3) pspace_relation_cte_wp_at [OF _ caps_of_state_cteD]) apply (drule_tac f="\<lambda>ctes. ctes (cte_map (a, b))" in arg_cong) apply (clarsimp simp: null_filter'_def cte_wp_at_ctes_of
                 split: if_split_asm) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(s, s') \<in> state_relation; t = kheap_update f (ekheap_update ef s); \<exists>f' g' h'. t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; null_filter (caps_of_state t) = null_filter (caps_of_state s); null_filter' (ctes_of t') = null_filter' (ctes_of s'); pspace_relation (kheap t) (ksPSpace t'); ekheap_relation (ekheap t) (ksPSpace t'); ghost_relation (kheap t) (gsUserPages t') (gsCNodes t'); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; pspace_aligned' t'; pspace_distinct' t'; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s)\<rbrakk> \<Longrightarrow> (t, t') \<in> state_relation proof (prove)
goal (1 subgoal):
 1. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (kheap_update f (ekheap_update ef s))) (cdt s) (map_to_ctes (f' (ksPSpace s'))) \<and> cdt_list_relation (cdt_list s) (cdt s) (map_to_ctes (f' (ksPSpace s'))) \<and> revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (map_to_ctes (f' (ksPSpace s'))) proof (prove)
goal (3 subgoals):
 1. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (kheap_update f (ekheap_update ef s))) (cdt s) (map_to_ctes (f' (ksPSpace s')))
 2. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list s) (cdt s) (map_to_ctes (f' (ksPSpace s')))
 3. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (map_to_ctes (f' (ksPSpace s'))) proof (prove)
goal (3 subgoals):
 1. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); \<forall>a b. (\<exists>cap. caps_of_state s (a, b) = Some cap) \<longrightarrow> cte_map ` descendants_of (a, b) (cdt s) = descendants_of' (cte_map (a, b)) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> \<forall>a b. (\<exists>cap. caps_of_state (kheap_update f s) (a, b) = Some cap) \<longrightarrow> cte_map ` descendants_of (a, b) (cdt s) = descendants_of' (cte_map (a, b)) (map_to_ctes (f' (ksPSpace s')))
 2. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list s) (cdt s) (map_to_ctes (f' (ksPSpace s')))
 3. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (map_to_ctes (f' (ksPSpace s'))) proof (prove)
goal (3 subgoals):
 1. \<And>f' g' h' a b. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; (\<exists>cap. caps_of_state s (a, b) = Some cap) \<longrightarrow> cte_map ` descendants_of (a, b) (cdt s) = descendants_of' (cte_map (a, b)) (ctes_of s')\<rbrakk> \<Longrightarrow> (\<exists>cap. caps_of_state (kheap_update f s) (a, b) = Some cap) \<longrightarrow> cte_map ` descendants_of (a, b) (cdt s) = descendants_of' (cte_map (a, b)) (map_to_ctes (f' (ksPSpace s')))
 2. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list s) (cdt s) (map_to_ctes (f' (ksPSpace s')))
 3. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (map_to_ctes (f' (ksPSpace s'))) proof (prove)
goal (3 subgoals):
 1. \<And>f' g' h' a b cap. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; (\<exists>cap. caps_of_state s (a, b) = Some cap) \<longrightarrow> cte_map ` descendants_of (a, b) (cdt s) = descendants_of' (cte_map (a, b)) (ctes_of s'); caps_of_state (kheap_update f s) (a, b) = Some cap\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (a, b) (cdt s) = descendants_of' (cte_map (a, b)) (map_to_ctes (f' (ksPSpace s')))
 2. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list s) (cdt s) (map_to_ctes (f' (ksPSpace s')))
 3. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (map_to_ctes (f' (ksPSpace s'))) proof (prove)
goal (4 subgoals):
 1. \<And>f' g' h' a b cap. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; (\<exists>cap. caps_of_state s (a, b) = Some cap) \<longrightarrow> cte_map ` descendants_of (a, b) (cdt s) = descendants_of' (cte_map (a, b)) (ctes_of s'); caps_of_state (kheap_update f s) (a, b) = Some cap; caps_of_state s (a, b) = Some cap\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (a, b) (cdt s) = descendants_of' (cte_map (a, b)) (map_to_ctes (f' (ksPSpace s')))
 2. \<And>f' g' h' a b cap. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; (\<exists>cap. caps_of_state s (a, b) = Some cap) \<longrightarrow> cte_map ` descendants_of (a, b) (cdt s) = descendants_of' (cte_map (a, b)) (ctes_of s'); caps_of_state (kheap_update f s) (a, b) = Some cap; cap = cap.NullCap; caps_of_state s (a, b) = None\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (a, b) (cdt s) = descendants_of' (cte_map (a, b)) (map_to_ctes (f' (ksPSpace s')))
 3. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list s) (cdt s) (map_to_ctes (f' (ksPSpace s')))
 4. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (map_to_ctes (f' (ksPSpace s'))) proof (prove)
goal (4 subgoals):
 1. \<And>f' g' h' a b cap. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; cte_map ` descendants_of (a, b) (cdt s) = descendants_of' (cte_map (a, b)) (ctes_of s'); caps_of_state (kheap_update f s) (a, b) = Some cap; caps_of_state s (a, b) = Some cap\<rbrakk> \<Longrightarrow> descendants_of' (cte_map (a, b)) (ctes_of s') = descendants_of' (cte_map (a, b)) (map_to_ctes (f' (ksPSpace s')))
 2. \<And>f' g' h' a b cap. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; (\<exists>cap. caps_of_state s (a, b) = Some cap) \<longrightarrow> cte_map ` descendants_of (a, b) (cdt s) = descendants_of' (cte_map (a, b)) (ctes_of s'); caps_of_state (kheap_update f s) (a, b) = Some cap; cap = cap.NullCap; caps_of_state s (a, b) = None\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (a, b) (cdt s) = descendants_of' (cte_map (a, b)) (map_to_ctes (f' (ksPSpace s')))
 3. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list s) (cdt s) (map_to_ctes (f' (ksPSpace s')))
 4. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (map_to_ctes (f' (ksPSpace s'))) proof (prove)
goal (3 subgoals):
 1. \<And>f' g' h' a b cap. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; (\<exists>cap. caps_of_state s (a, b) = Some cap) \<longrightarrow> cte_map ` descendants_of (a, b) (cdt s) = descendants_of' (cte_map (a, b)) (ctes_of s'); caps_of_state (kheap_update f s) (a, b) = Some cap; cap = cap.NullCap; caps_of_state s (a, b) = None\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (a, b) (cdt s) = descendants_of' (cte_map (a, b)) (map_to_ctes (f' (ksPSpace s')))
 2. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list s) (cdt s) (map_to_ctes (f' (ksPSpace s')))
 3. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (map_to_ctes (f' (ksPSpace s'))) proof (prove)
goal (3 subgoals):
 1. \<And>f' g' h' a b cap. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; caps_of_state (kheap_update f s) (a, b) = Some cap.NullCap; cap = cap.NullCap; caps_of_state s (a, b) = None\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (a, b) (cdt s) = descendants_of' (cte_map (a, b)) (map_to_ctes (f' (ksPSpace s')))
 2. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list s) (cdt s) (map_to_ctes (f' (ksPSpace s')))
 3. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (map_to_ctes (f' (ksPSpace s'))) proof (prove)
goal (4 subgoals):
 1. \<And>f' g' h' a b cap. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; caps_of_state (kheap_update f s) (a, b) = Some cap.NullCap; cap = cap.NullCap; caps_of_state s (a, b) = None; cdt s (a, b) = None\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (a, b) (cdt s) = descendants_of' (cte_map (a, b)) (map_to_ctes (f' (ksPSpace s')))
 2. \<And>f' g' h' a b cap aa. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; caps_of_state (kheap_update f s) (a, b) = Some cap.NullCap; cap = cap.NullCap; caps_of_state s (a, b) = None; cdt s (a, b) = Some aa\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (a, b) (cdt s) = descendants_of' (cte_map (a, b)) (map_to_ctes (f' (ksPSpace s')))
 3. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list s) (cdt s) (map_to_ctes (f' (ksPSpace s')))
 4. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (map_to_ctes (f' (ksPSpace s'))) proof (prove)
goal (5 subgoals):
 1. \<And>f' g' h' a b cap. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; caps_of_state (kheap_update f s) (a, b) = Some cap.NullCap; cap = cap.NullCap; caps_of_state s (a, b) = None; cdt s (a, b) = None\<rbrakk> \<Longrightarrow> \<not> swp (cte_wp_at ((\<noteq>) cap.NullCap)) s (a, b)
 2. \<And>f' g' h' a b cap. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; caps_of_state (kheap_update f s) (a, b) = Some cap.NullCap; cap = cap.NullCap; caps_of_state s (a, b) = None; cdt s (a, b) = None\<rbrakk> \<Longrightarrow> cte_map ` {} = descendants_of' (cte_map (a, b)) (map_to_ctes (f' (ksPSpace s')))
 3. \<And>f' g' h' a b cap aa. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; caps_of_state (kheap_update f s) (a, b) = Some cap.NullCap; cap = cap.NullCap; caps_of_state s (a, b) = None; cdt s (a, b) = Some aa\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (a, b) (cdt s) = descendants_of' (cte_map (a, b)) (map_to_ctes (f' (ksPSpace s')))
 4. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list s) (cdt s) (map_to_ctes (f' (ksPSpace s')))
 5. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (map_to_ctes (f' (ksPSpace s'))) proof (prove)
goal (4 subgoals):
 1. \<And>f' g' h' a b cap. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; caps_of_state (kheap_update f s) (a, b) = Some cap.NullCap; cap = cap.NullCap; caps_of_state s (a, b) = None; cdt s (a, b) = None\<rbrakk> \<Longrightarrow> cte_map ` {} = descendants_of' (cte_map (a, b)) (map_to_ctes (f' (ksPSpace s')))
 2. \<And>f' g' h' a b cap aa. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; caps_of_state (kheap_update f s) (a, b) = Some cap.NullCap; cap = cap.NullCap; caps_of_state s (a, b) = None; cdt s (a, b) = Some aa\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (a, b) (cdt s) = descendants_of' (cte_map (a, b)) (map_to_ctes (f' (ksPSpace s')))
 3. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list s) (cdt s) (map_to_ctes (f' (ksPSpace s')))
 4. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (map_to_ctes (f' (ksPSpace s'))) proof (prove)
goal (5 subgoals):
 1. \<And>f' g' h' a b cap. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; caps_of_state (kheap_update f s) (a, b) = Some cap.NullCap; cap = cap.NullCap; caps_of_state s (a, b) = None; cdt s (a, b) = None\<rbrakk> \<Longrightarrow> cte_wp_at ((=) (?c65 f' g' h' a b cap.NullCap)) (?slot65 f' g' h' a b cap.NullCap) (kheap_update f s)
 2. \<And>f' g' h' a b cap. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; caps_of_state (kheap_update f s) (a, b) = Some cap.NullCap; cap = cap.NullCap; caps_of_state s (a, b) = None; cdt s (a, b) = None; \<exists>cte. map_to_ctes (f' (ksPSpace s')) (cte_map (?slot65 f' g' h' a b cap.NullCap)) = Some cte \<and> cap_relation (?c65 f' g' h' a b cap.NullCap) (cteCap cte)\<rbrakk> \<Longrightarrow> {} = descendants_of' (cte_map (a, b)) (map_to_ctes (f' (ksPSpace s')))
 3. \<And>f' g' h' a b cap aa. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; caps_of_state (kheap_update f s) (a, b) = Some cap.NullCap; cap = cap.NullCap; caps_of_state s (a, b) = None; cdt s (a, b) = Some aa\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (a, b) (cdt s) = descendants_of' (cte_map (a, b)) (map_to_ctes (f' (ksPSpace s')))
 4. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list s) (cdt s) (map_to_ctes (f' (ksPSpace s')))
 5. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (map_to_ctes (f' (ksPSpace s'))) proof (prove)
goal (5 subgoals):
 1. \<And>f' g' h' a b cap. \<lbrakk>t = ekheap_update ef (kheap_update f s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; caps_of_state (kheap_update f s) (a, b) = Some cap.NullCap; cap = cap.NullCap; caps_of_state s (a, b) = None; cdt s (a, b) = None\<rbrakk> \<Longrightarrow> cte_wp_at ((=) (?c65 f' g' h' a b cap.NullCap)) (?slot65 f' g' h' a b cap.NullCap) (kheap_update f s)
 2. \<And>f' g' h' a b cap. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; caps_of_state (kheap_update f s) (a, b) = Some cap.NullCap; cap = cap.NullCap; caps_of_state s (a, b) = None; cdt s (a, b) = None; \<exists>cte. map_to_ctes (f' (ksPSpace s')) (cte_map (?slot65 f' g' h' a b cap.NullCap)) = Some cte \<and> cap_relation (?c65 f' g' h' a b cap.NullCap) (cteCap cte)\<rbrakk> \<Longrightarrow> {} = descendants_of' (cte_map (a, b)) (map_to_ctes (f' (ksPSpace s')))
 3. \<And>f' g' h' a b cap aa. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; caps_of_state (kheap_update f s) (a, b) = Some cap.NullCap; cap = cap.NullCap; caps_of_state s (a, b) = None; cdt s (a, b) = Some aa\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (a, b) (cdt s) = descendants_of' (cte_map (a, b)) (map_to_ctes (f' (ksPSpace s')))
 4. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list s) (cdt s) (map_to_ctes (f' (ksPSpace s')))
 5. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (map_to_ctes (f' (ksPSpace s'))) proof (prove)
goal (4 subgoals):
 1. \<And>f' g' h' a b cap. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; caps_of_state (kheap_update f s) (a, b) = Some cap.NullCap; cap = cap.NullCap; caps_of_state s (a, b) = None; cdt s (a, b) = None; \<exists>cte. map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some cte \<and> cap_relation cap.NullCap (cteCap cte)\<rbrakk> \<Longrightarrow> {} = descendants_of' (cte_map (a, b)) (map_to_ctes (f' (ksPSpace s')))
 2. \<And>f' g' h' a b cap aa. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; caps_of_state (kheap_update f s) (a, b) = Some cap.NullCap; cap = cap.NullCap; caps_of_state s (a, b) = None; cdt s (a, b) = Some aa\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (a, b) (cdt s) = descendants_of' (cte_map (a, b)) (map_to_ctes (f' (ksPSpace s')))
 3. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list s) (cdt s) (map_to_ctes (f' (ksPSpace s')))
 4. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (map_to_ctes (f' (ksPSpace s'))) proof (prove)
goal (4 subgoals):
 1. \<And>f' g' h' a b cte x. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; caps_of_state (kheap_update f s) (a, b) = Some cap.NullCap; caps_of_state s (a, b) = None; cdt s (a, b) = None; map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; map_to_ctes (f' (ksPSpace s')) \<turnstile> cte_map (a, b) \<rightarrow> x\<rbrakk> \<Longrightarrow> False
 2. \<And>f' g' h' a b cap aa. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; caps_of_state (kheap_update f s) (a, b) = Some cap.NullCap; cap = cap.NullCap; caps_of_state s (a, b) = None; cdt s (a, b) = Some aa\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (a, b) (cdt s) = descendants_of' (cte_map (a, b)) (map_to_ctes (f' (ksPSpace s')))
 3. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list s) (cdt s) (map_to_ctes (f' (ksPSpace s')))
 4. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (map_to_ctes (f' (ksPSpace s'))) proof (prove)
goal (4 subgoals):
 1. \<And>f' g' h' a b cte x x1 x2. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; caps_of_state (kheap_update f s) (a, b) = Some cap.NullCap; caps_of_state s (a, b) = None; cdt s (a, b) = None; map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; map_to_ctes (f' (ksPSpace s')) \<turnstile> cte_map (a, b) \<rightarrow> x; cte = CTE x1 x2\<rbrakk> \<Longrightarrow> False
 2. \<And>f' g' h' a b cap aa. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; caps_of_state (kheap_update f s) (a, b) = Some cap.NullCap; cap = cap.NullCap; caps_of_state s (a, b) = None; cdt s (a, b) = Some aa\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (a, b) (cdt s) = descendants_of' (cte_map (a, b)) (map_to_ctes (f' (ksPSpace s')))
 3. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list s) (cdt s) (map_to_ctes (f' (ksPSpace s')))
 4. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (map_to_ctes (f' (ksPSpace s'))) proof (prove)
goal (4 subgoals):
 1. \<And>f' g' h' a b cte x x1 x2. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; caps_of_state (kheap_update f s) (a, b) = Some cap.NullCap; caps_of_state s (a, b) = None; cdt s (a, b) = None; map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; cte = CTE x1 x2\<rbrakk> \<Longrightarrow> map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE capability.NullCap (?node82 f' g' h' a b cte x x1 x2))
 2. \<And>f' g' h' a b cap aa. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; caps_of_state (kheap_update f s) (a, b) = Some cap.NullCap; cap = cap.NullCap; caps_of_state s (a, b) = None; cdt s (a, b) = Some aa\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (a, b) (cdt s) = descendants_of' (cte_map (a, b)) (map_to_ctes (f' (ksPSpace s')))
 3. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list s) (cdt s) (map_to_ctes (f' (ksPSpace s')))
 4. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (map_to_ctes (f' (ksPSpace s'))) proof (prove)
goal (3 subgoals):
 1. \<And>f' g' h' a b cap aa. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; caps_of_state (kheap_update f s) (a, b) = Some cap.NullCap; cap = cap.NullCap; caps_of_state s (a, b) = None; cdt s (a, b) = Some aa\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (a, b) (cdt s) = descendants_of' (cte_map (a, b)) (map_to_ctes (f' (ksPSpace s')))
 2. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list s) (cdt s) (map_to_ctes (f' (ksPSpace s')))
 3. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (map_to_ctes (f' (ksPSpace s'))) proof (prove)
goal (3 subgoals):
 1. \<And>f' g' h' a b cap aa. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; caps_of_state (kheap_update f s) (a, b) = Some cap.NullCap; cap = cap.NullCap; caps_of_state s (a, b) = None; swp (cte_wp_at ((\<noteq>) cap.NullCap)) s aa \<and> swp (cte_wp_at ((\<noteq>) cap.NullCap)) s (a, b)\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (a, b) (cdt s) = descendants_of' (cte_map (a, b)) (map_to_ctes (f' (ksPSpace s')))
 2. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list s) (cdt s) (map_to_ctes (f' (ksPSpace s')))
 3. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (map_to_ctes (f' (ksPSpace s'))) proof (prove)
goal (2 subgoals):
 1. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list s) (cdt s) (map_to_ctes (f' (ksPSpace s')))
 2. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (map_to_ctes (f' (ksPSpace s'))) proof (prove)
goal (2 subgoals):
 1. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); \<forall>a b cap node. ctes_of s' (cte_map (a, b)) = Some (CTE cap node) \<longrightarrow> (case next_slot (a, b) (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> \<forall>a b cap node. map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE cap node) \<longrightarrow> (case next_slot (a, b) (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next)
 2. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (map_to_ctes (f' (ksPSpace s'))) proof (prove)
goal (2 subgoals):
 1. \<And>f' g' h' a b cap node. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; ctes_of s' (cte_map (a, b)) = Some (CTE cap node) \<longrightarrow> (case next_slot (a, b) (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next)\<rbrakk> \<Longrightarrow> map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE cap node) \<longrightarrow> (case next_slot (a, b) (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next)
 2. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (map_to_ctes (f' (ksPSpace s'))) proof (prove)
goal (2 subgoals):
 1. \<And>f' g' h' a b cap node. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE cap node); ctes_of s' (cte_map (a, b)) \<noteq> Some (CTE cap node)\<rbrakk> \<Longrightarrow> case next_slot (a, b) (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (map_to_ctes (f' (ksPSpace s'))) proof (prove)
goal (3 subgoals):
 1. \<And>f' g' h' a b cap node. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE cap node); ctes_of s' (cte_map (a, b)) \<noteq> Some (CTE cap node); next_slot (a, b) (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> case next_slot (a, b) (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>f' g' h' a b cap node aa. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE cap node); ctes_of s' (cte_map (a, b)) \<noteq> Some (CTE cap node); next_slot (a, b) (cdt_list s) (cdt s) = Some aa\<rbrakk> \<Longrightarrow> case next_slot (a, b) (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 3. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (map_to_ctes (f' (ksPSpace s'))) proof (prove)
goal (2 subgoals):
 1. \<And>f' g' h' a b cap node aa. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE cap node); ctes_of s' (cte_map (a, b)) \<noteq> Some (CTE cap node); next_slot (a, b) (cdt_list s) (cdt s) = Some aa\<rbrakk> \<Longrightarrow> case next_slot (a, b) (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (map_to_ctes (f' (ksPSpace s'))) proof (prove)
goal (3 subgoals):
 1. \<And>f' g' h' a b cap node aa. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE cap node); ctes_of s' (cte_map (a, b)) \<noteq> Some (CTE cap node); next_slot (a, b) (cdt_list s) (cdt s) = Some aa; cte_wp_at (\<lambda>c. c \<noteq> cap.NullCap) (a, b) s\<rbrakk> \<Longrightarrow> case next_slot (a, b) (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>f' g' h' a b cap node aa. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE cap node); ctes_of s' (cte_map (a, b)) \<noteq> Some (CTE cap node); next_slot (a, b) (cdt_list s) (cdt s) = Some aa\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. c \<noteq> cap.NullCap) (a, b) s
 3. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (map_to_ctes (f' (ksPSpace s'))) proof (prove)
goal (3 subgoals):
 1. \<And>f' g' h' a b cap node aa. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE cap node); ctes_of s' (cte_map (a, b)) \<noteq> Some (CTE cap node); next_slot (a, b) (cdt_list s) (cdt s) = Some aa; cte_wp_at (\<lambda>c. c \<noteq> cap.NullCap) (a, b) s; null_filter (caps_of_state (kheap_update f s)) (a, b) = null_filter (caps_of_state s) (a, b)\<rbrakk> \<Longrightarrow> case next_slot (a, b) (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>f' g' h' a b cap node aa. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE cap node); ctes_of s' (cte_map (a, b)) \<noteq> Some (CTE cap node); next_slot (a, b) (cdt_list s) (cdt s) = Some aa\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. c \<noteq> cap.NullCap) (a, b) s
 3. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (map_to_ctes (f' (ksPSpace s'))) proof (prove)
goal (3 subgoals):
 1. \<And>f' g' h' a b cap node aa ba capa. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE cap node); ctes_of s' (cte_map (a, b)) \<noteq> Some (CTE cap node); next_slot (a, b) (cdt_list s) (cdt s) = Some (aa, ba); null_filter (caps_of_state (kheap_update f s)) (a, b) = null_filter (caps_of_state s) (a, b); caps_of_state s (a, b) = Some capa; capa \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (aa, ba)
 2. \<And>f' g' h' a b cap node aa. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE cap node); ctes_of s' (cte_map (a, b)) \<noteq> Some (CTE cap node); next_slot (a, b) (cdt_list s) (cdt s) = Some aa\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. c \<noteq> cap.NullCap) (a, b) s
 3. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (map_to_ctes (f' (ksPSpace s'))) proof (prove)
goal (3 subgoals):
 1. \<And>f' g' h' a b cap node aa ba capa. \<lbrakk>revokable_relation (is_original_cap s) (\<lambda>x. if caps_of_state s x = Some cap.NullCap then None else caps_of_state s x) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE cap node); ctes_of s' (cte_map (a, b)) \<noteq> Some (CTE cap node); next_slot (a, b) (cdt_list s) (cdt s) = Some (aa, ba); caps_of_state s (a, b) = Some capa; capa \<noteq> cap.NullCap; t = kheap_update f (ekheap_update ef s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); caps_of_state (kheap_update f s) (a, b) = Some capa\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (aa, ba)
 2. \<And>f' g' h' a b cap node aa. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE cap node); ctes_of s' (cte_map (a, b)) \<noteq> Some (CTE cap node); next_slot (a, b) (cdt_list s) (cdt s) = Some aa\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. c \<noteq> cap.NullCap) (a, b) s
 3. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (map_to_ctes (f' (ksPSpace s'))) proof (prove)
goal (3 subgoals):
 1. \<And>f' g' h' a b cap node aa ba capa. \<lbrakk>revokable_relation (is_original_cap s) (\<lambda>x. if caps_of_state s x = Some cap.NullCap then None else caps_of_state s x) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE cap node); ctes_of s' (cte_map (a, b)) \<noteq> Some (CTE cap node); next_slot (a, b) (cdt_list s) (cdt s) = Some (aa, ba); caps_of_state s (a, b) = Some capa; capa \<noteq> cap.NullCap; t = kheap_update f (ekheap_update ef s); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); caps_of_state (kheap_update f s) (a, b) = Some capa; null_filter' (map_to_ctes (f' (ksPSpace s'))) (cte_map (a, b)) = null_filter' (ctes_of s') (cte_map (a, b))\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (aa, ba)
 2. \<And>f' g' h' a b cap node aa. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE cap node); ctes_of s' (cte_map (a, b)) \<noteq> Some (CTE cap node); next_slot (a, b) (cdt_list s) (cdt s) = Some aa\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. c \<noteq> cap.NullCap) (a, b) s
 3. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (map_to_ctes (f' (ksPSpace s'))) proof (prove)
goal (3 subgoals):
 1. \<And>f' g' h' a b cap node aa ba capa. \<lbrakk>revokable_relation (is_original_cap s) (\<lambda>x. if caps_of_state s x = Some cap.NullCap then None else caps_of_state s x) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE capability.NullCap nullMDBNode); next_slot (a, b) (cdt_list s) (cdt s) = Some (aa, ba); caps_of_state s (a, b) = Some capa; capa \<noteq> cap.NullCap; t = kheap_update f (ekheap_update ef s); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); caps_of_state (kheap_update f s) (a, b) = Some capa; cap = capability.NullCap; node = nullMDBNode; None = ctes_of s' (cte_map (a, b))\<rbrakk> \<Longrightarrow> nullPointer = cte_map (aa, ba)
 2. \<And>f' g' h' a b cap node aa. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE cap node); ctes_of s' (cte_map (a, b)) \<noteq> Some (CTE cap node); next_slot (a, b) (cdt_list s) (cdt s) = Some aa\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. c \<noteq> cap.NullCap) (a, b) s
 3. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (map_to_ctes (f' (ksPSpace s'))) proof (prove)
goal (6 subgoals):
 1. \<And>f' g' h' a b cap node aa ba capa. \<lbrakk>revokable_relation (is_original_cap s) (\<lambda>x. if caps_of_state s x = Some cap.NullCap then None else caps_of_state s x) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE capability.NullCap nullMDBNode); next_slot (a, b) (cdt_list s) (cdt s) = Some (aa, ba); caps_of_state s (a, b) = Some capa; capa \<noteq> cap.NullCap; t = kheap_update f (ekheap_update ef s); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); caps_of_state (kheap_update f s) (a, b) = Some capa; cap = capability.NullCap; node = nullMDBNode; None = ctes_of s' (cte_map (a, b))\<rbrakk> \<Longrightarrow> cte_wp_at ((=) (?c156 f' g' h' a b cap node aa ba capa)) (?cref156 f' g' h' a b cap node aa ba capa, ?oref156 f' g' h' a b cap node aa ba capa) s
 2. \<And>f' g' h' a b cap node aa ba capa. \<lbrakk>revokable_relation (is_original_cap s) (\<lambda>x. if caps_of_state s x = Some cap.NullCap then None else caps_of_state s x) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE capability.NullCap nullMDBNode); next_slot (a, b) (cdt_list s) (cdt s) = Some (aa, ba); caps_of_state s (a, b) = Some capa; capa \<noteq> cap.NullCap; t = kheap_update f (ekheap_update ef s); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); caps_of_state (kheap_update f s) (a, b) = Some capa; cap = capability.NullCap; node = nullMDBNode; None = ctes_of s' (cte_map (a, b))\<rbrakk> \<Longrightarrow> pspace_aligned' s'
 3. \<And>f' g' h' a b cap node aa ba capa. \<lbrakk>revokable_relation (is_original_cap s) (\<lambda>x. if caps_of_state s x = Some cap.NullCap then None else caps_of_state s x) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE capability.NullCap nullMDBNode); next_slot (a, b) (cdt_list s) (cdt s) = Some (aa, ba); caps_of_state s (a, b) = Some capa; capa \<noteq> cap.NullCap; t = kheap_update f (ekheap_update ef s); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); caps_of_state (kheap_update f s) (a, b) = Some capa; cap = capability.NullCap; node = nullMDBNode; None = ctes_of s' (cte_map (a, b))\<rbrakk> \<Longrightarrow> pspace_distinct' s'
 4. \<And>f' g' h' a b cap node aa ba capa. \<lbrakk>revokable_relation (is_original_cap s) (\<lambda>x. if caps_of_state s x = Some cap.NullCap then None else caps_of_state s x) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE capability.NullCap nullMDBNode); next_slot (a, b) (cdt_list s) (cdt s) = Some (aa, ba); caps_of_state s (a, b) = Some capa; capa \<noteq> cap.NullCap; t = kheap_update f (ekheap_update ef s); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); caps_of_state (kheap_update f s) (a, b) = Some capa; cap = capability.NullCap; node = nullMDBNode; None = ctes_of s' (cte_map (a, b)); cte_wp_at' (\<lambda>cte. cap_relation (?c156 f' g' h' a b cap node aa ba capa) (cteCap cte)) (cte_map (?cref156 f' g' h' a b cap node aa ba capa, ?oref156 f' g' h' a b cap node aa ba capa)) s'\<rbrakk> \<Longrightarrow> nullPointer = cte_map (aa, ba)
 5. \<And>f' g' h' a b cap node aa. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE cap node); ctes_of s' (cte_map (a, b)) \<noteq> Some (CTE cap node); next_slot (a, b) (cdt_list s) (cdt s) = Some aa\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. c \<noteq> cap.NullCap) (a, b) s
 6. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (map_to_ctes (f' (ksPSpace s'))) proof (prove)
goal (5 subgoals):
 1. \<And>f' g' h' a b cap node aa ba capa. \<lbrakk>revokable_relation (is_original_cap s) (\<lambda>x. if caps_of_state s x = Some cap.NullCap then None else caps_of_state s x) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE capability.NullCap nullMDBNode); next_slot (a, b) (cdt_list s) (cdt s) = Some (aa, ba); caps_of_state s (a, b) = Some capa; capa \<noteq> cap.NullCap; t = kheap_update f (ekheap_update ef s); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); caps_of_state (kheap_update f s) (a, b) = Some capa; cap = capability.NullCap; node = nullMDBNode; None = ctes_of s' (cte_map (a, b))\<rbrakk> \<Longrightarrow> pspace_aligned' s'
 2. \<And>f' g' h' a b cap node aa ba capa. \<lbrakk>revokable_relation (is_original_cap s) (\<lambda>x. if caps_of_state s x = Some cap.NullCap then None else caps_of_state s x) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE capability.NullCap nullMDBNode); next_slot (a, b) (cdt_list s) (cdt s) = Some (aa, ba); caps_of_state s (a, b) = Some capa; capa \<noteq> cap.NullCap; t = kheap_update f (ekheap_update ef s); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); caps_of_state (kheap_update f s) (a, b) = Some capa; cap = capability.NullCap; node = nullMDBNode; None = ctes_of s' (cte_map (a, b))\<rbrakk> \<Longrightarrow> pspace_distinct' s'
 3. \<And>f' g' h' a b cap node aa ba capa. \<lbrakk>revokable_relation (is_original_cap s) (\<lambda>x. if caps_of_state s x = Some cap.NullCap then None else caps_of_state s x) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE capability.NullCap nullMDBNode); next_slot (a, b) (cdt_list s) (cdt s) = Some (aa, ba); caps_of_state s (a, b) = Some capa; capa \<noteq> cap.NullCap; t = kheap_update f (ekheap_update ef s); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); caps_of_state (kheap_update f s) (a, b) = Some capa; cap = capability.NullCap; node = nullMDBNode; None = ctes_of s' (cte_map (a, b)); cte_wp_at' (\<lambda>cte. cap_relation capa (cteCap cte)) (cte_map (a, b)) s'\<rbrakk> \<Longrightarrow> nullPointer = cte_map (aa, ba)
 4. \<And>f' g' h' a b cap node aa. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE cap node); ctes_of s' (cte_map (a, b)) \<noteq> Some (CTE cap node); next_slot (a, b) (cdt_list s) (cdt s) = Some aa\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. c \<noteq> cap.NullCap) (a, b) s
 5. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (map_to_ctes (f' (ksPSpace s'))) proof (prove)
goal (4 subgoals):
 1. \<And>f' g' h' a b cap node aa ba capa. \<lbrakk>revokable_relation (is_original_cap s) (\<lambda>x. if caps_of_state s x = Some cap.NullCap then None else caps_of_state s x) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE capability.NullCap nullMDBNode); next_slot (a, b) (cdt_list s) (cdt s) = Some (aa, ba); caps_of_state s (a, b) = Some capa; capa \<noteq> cap.NullCap; t = kheap_update f (ekheap_update ef s); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); caps_of_state (kheap_update f s) (a, b) = Some capa; cap = capability.NullCap; node = nullMDBNode; None = ctes_of s' (cte_map (a, b))\<rbrakk> \<Longrightarrow> pspace_distinct' s'
 2. \<And>f' g' h' a b cap node aa ba capa. \<lbrakk>revokable_relation (is_original_cap s) (\<lambda>x. if caps_of_state s x = Some cap.NullCap then None else caps_of_state s x) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE capability.NullCap nullMDBNode); next_slot (a, b) (cdt_list s) (cdt s) = Some (aa, ba); caps_of_state s (a, b) = Some capa; capa \<noteq> cap.NullCap; t = kheap_update f (ekheap_update ef s); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); caps_of_state (kheap_update f s) (a, b) = Some capa; cap = capability.NullCap; node = nullMDBNode; None = ctes_of s' (cte_map (a, b)); cte_wp_at' (\<lambda>cte. cap_relation capa (cteCap cte)) (cte_map (a, b)) s'\<rbrakk> \<Longrightarrow> nullPointer = cte_map (aa, ba)
 3. \<And>f' g' h' a b cap node aa. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE cap node); ctes_of s' (cte_map (a, b)) \<noteq> Some (CTE cap node); next_slot (a, b) (cdt_list s) (cdt s) = Some aa\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. c \<noteq> cap.NullCap) (a, b) s
 4. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (map_to_ctes (f' (ksPSpace s'))) proof (prove)
goal (3 subgoals):
 1. \<And>f' g' h' a b cap node aa ba capa. \<lbrakk>revokable_relation (is_original_cap s) (\<lambda>x. if caps_of_state s x = Some cap.NullCap then None else caps_of_state s x) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE capability.NullCap nullMDBNode); next_slot (a, b) (cdt_list s) (cdt s) = Some (aa, ba); caps_of_state s (a, b) = Some capa; capa \<noteq> cap.NullCap; t = kheap_update f (ekheap_update ef s); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); caps_of_state (kheap_update f s) (a, b) = Some capa; cap = capability.NullCap; node = nullMDBNode; None = ctes_of s' (cte_map (a, b)); cte_wp_at' (\<lambda>cte. cap_relation capa (cteCap cte)) (cte_map (a, b)) s'\<rbrakk> \<Longrightarrow> nullPointer = cte_map (aa, ba)
 2. \<And>f' g' h' a b cap node aa. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE cap node); ctes_of s' (cte_map (a, b)) \<noteq> Some (CTE cap node); next_slot (a, b) (cdt_list s) (cdt s) = Some aa\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. c \<noteq> cap.NullCap) (a, b) s
 3. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (map_to_ctes (f' (ksPSpace s'))) proof (prove)
goal (2 subgoals):
 1. \<And>f' g' h' a b cap node aa. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE cap node); ctes_of s' (cte_map (a, b)) \<noteq> Some (CTE cap node); next_slot (a, b) (cdt_list s) (cdt s) = Some aa\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. c \<noteq> cap.NullCap) (a, b) s
 2. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (map_to_ctes (f' (ksPSpace s'))) proof (prove)
goal (2 subgoals):
 1. \<And>f' g' h' a b cap node aa. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; \<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> cte_wp_at ((\<noteq>) cap.NullCap) (a, b) s \<and> cte_wp_at ((\<noteq>) cap.NullCap) (aa, ba) s; t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE cap node); ctes_of s' (cte_map (a, b)) \<noteq> Some (CTE cap node); next_slot (a, b) (cdt_list s) (cdt s) = Some aa\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. c \<noteq> cap.NullCap) (a, b) s
 2. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (map_to_ctes (f' (ksPSpace s'))) proof (prove)
goal (2 subgoals):
 1. \<And>f' g' h' a b cap node aa. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; \<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> cte_wp_at ((\<noteq>) cap.NullCap) (a, b) s \<and> cte_wp_at ((\<noteq>) cap.NullCap) (aa, ba) s; t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE cap node); ctes_of s' (cte_map (a, b)) \<noteq> Some (CTE cap node); next_slot (a, b) (cdt_list s) (cdt s) = Some aa; finite_depth (cdt s)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. c \<noteq> cap.NullCap) (a, b) s
 2. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (map_to_ctes (f' (ksPSpace s'))) proof (prove)
goal (2 subgoals):
 1. \<And>f' g' h' a b cap node aa. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; \<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> cte_wp_at ((\<noteq>) cap.NullCap) (a, b) s \<and> cte_wp_at ((\<noteq>) cap.NullCap) (aa, ba) s; t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE cap node); ctes_of s' (cte_map (a, b)) \<noteq> Some (CTE cap node); next_slot (a, b) (cdt_list s) (cdt s) = Some aa; finite_depth (cdt s); cte_wp_at (\<lambda>c. c \<noteq> cap.NullCap) (a, b) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. c \<noteq> cap.NullCap) (a, b) s
 2. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (map_to_ctes (f' (ksPSpace s'))) proof (prove)
goal (1 subgoal):
 1. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (map_to_ctes (f' (ksPSpace s'))) proof (prove)
goal (1 subgoal):
 1. \<And>f' g' h'. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); \<forall>a b. (\<exists>y. null_filter (caps_of_state s) (a, b) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of s' (cte_map (a, b)) = Some (CTE cap node) \<longrightarrow> is_original_cap s (a, b) = mdbRevocable node); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> \<forall>a b. (\<exists>y. null_filter (caps_of_state s) (a, b) = Some y) \<longrightarrow> (\<forall>cap node. map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE cap node) \<longrightarrow> is_original_cap s (a, b) = mdbRevocable node) proof (prove)
goal (1 subgoal):
 1. \<And>f' g' h' a b cap node. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; \<exists>y. null_filter (caps_of_state s) (a, b) = Some y; ctes_of s' (cte_map (a, b)) = Some (CTE cap node) \<longrightarrow> is_original_cap s (a, b) = mdbRevocable node\<rbrakk> \<Longrightarrow> map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE cap node) \<longrightarrow> is_original_cap s (a, b) = mdbRevocable node proof (prove)
goal (1 subgoal):
 1. \<And>f' g' h' a b cap node y. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; caps_of_state s (a, b) = Some y; y \<noteq> cap.NullCap; map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE cap node); ctes_of s' (cte_map (a, b)) \<noteq> Some (CTE cap node)\<rbrakk> \<Longrightarrow> is_original_cap s (a, b) = mdbRevocable node proof (prove)
goal (1 subgoal):
 1. \<And>f' g' h' a b cap node y. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); null_filter' (map_to_ctes (f' (ksPSpace s'))) = null_filter' (ctes_of s'); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; caps_of_state s (a, b) = Some y; y \<noteq> cap.NullCap; map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE cap node); ctes_of s' (cte_map (a, b)) \<noteq> Some (CTE cap node); cte_wp_at' (\<lambda>cte. cap_relation y (cteCap cte)) (cte_map (a, b)) s'\<rbrakk> \<Longrightarrow> is_original_cap s (a, b) = mdbRevocable node proof (prove)
goal (1 subgoal):
 1. \<And>f' g' h' a b cap node y. \<lbrakk>t = kheap_update f (ekheap_update ef s); null_filter (caps_of_state (kheap_update f s)) = null_filter (caps_of_state s); pspace_relation (f (kheap s)) (f' (ksPSpace s')); ekheap_relation (ef (ekheap s)) (f' (ksPSpace s')); ghost_relation (f (kheap s)) (g' (gsUserPages s')) (h' (gsCNodes s')); valid_list s; pspace_aligned' s'; pspace_distinct' s'; valid_objs s; valid_mdb s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s); t' = s'\<lparr>ksPSpace := f' (ksPSpace s'), gsUserPages := g' (gsUserPages s'), gsCNodes := h' (gsCNodes s')\<rparr>; pspace_distinct' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); pspace_aligned' (s'\<lparr>ksPSpace := f' (ksPSpace s')\<rparr>); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; caps_of_state s (a, b) = Some y; y \<noteq> cap.NullCap; map_to_ctes (f' (ksPSpace s')) (cte_map (a, b)) = Some (CTE cap node); ctes_of s' (cte_map (a, b)) \<noteq> Some (CTE cap node); cte_wp_at' (\<lambda>cte. cap_relation y (cteCap cte)) (cte_map (a, b)) s'; null_filter' (map_to_ctes (f' (ksPSpace s'))) (cte_map (a, b)) = null_filter' (ctes_of s') (cte_map (a, b))\<rbrakk> \<Longrightarrow> is_original_cap s (a, b) = mdbRevocable node proof (prove)
goal:
No subgoals!