theory CSpace1_R

lemma updateCap_corres:
  "\<lbrakk>cap_relation cap cap';
    is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap \<rbrakk>
   \<Longrightarrow> corres dc (\<lambda>s. invs s \<and>
                      cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or>
                                      is_thread_cap c) \<and>
                                     is_final_cap' c s \<and>
                                     obj_ref_of c = obj_ref_of cap \<and>
                                     obj_size c = obj_size cap) slot s)
                 invs'
                 (set_cap cap slot) (updateCap (cte_map slot) cap')" apply (rule corres_stronger_no_failI) apply (rule no_fail_pre, wp) apply clarsimp apply (drule cte_wp_at_norm) apply (clarsimp simp: state_relation_def) apply (drule (1) pspace_relation_ctes_ofI) apply fastforce apply fastforce apply (clarsimp simp: cte_wp_at_ctes_of) apply (clarsimp simp add: state_relation_def) apply (drule(1) pspace_relationsD) apply (frule (3) set_cap_not_quite_corres; fastforce?) apply (erule cte_wp_at_weakenE, rule TrueI) apply clarsimp apply (rule bexI) prefer 2 apply simp apply (clarsimp simp: in_set_cap_cte_at_swp pspace_relations_def) apply (drule updateCap_stuff) apply simp apply (rule conjI) apply (clarsimp simp: ghost_relation_typ_at set_cap_a_type_inv data_at_def) apply (rule conjI) prefer 2 apply (rule conjI) apply (unfold cdt_list_relation_def)[1] apply (intro allI impI) apply (erule_tac x=c in allE) apply (auto elim!: modify_map_casesE)[1] apply (unfold revokable_relation_def)[1] apply (drule set_cap_caps_of_state_monad) apply (simp add: cte_wp_at_caps_of_state del: split_paired_All) apply (intro allI impI) apply (erule_tac x=c in allE) apply (erule impE[where P="\<exists>y. v = Some y" for v]) apply (clarsimp simp: null_filter_def is_zombie_def split: if_split_asm) apply (auto elim!: modify_map_casesE del: disjE)[1] apply (case_tac "ctes_of b (cte_map slot)") apply (simp add: modify_map_None) apply (simp add: modify_map_apply) apply (simp add: cdt_relation_def del: split_paired_All) apply (intro allI impI) apply (rule use_update_ztc_one [OF descendants_of_update_ztc]) apply simp apply assumption apply (auto simp: is_cap_simps isCap_simps)[1] apply (frule(3) is_final_untyped_ptrs [OF _ _ not_sym], clarsimp+) apply (clarsimp simp: cte_wp_at_caps_of_state) apply (simp add: is_cap_simps, elim disjE exE, simp_all)[1] apply (simp add: eq_commute) apply (drule cte_wp_at_norm, clarsimp) apply (drule(1) pspace_relation_ctes_ofI, clarsimp+) apply (drule(1) capClass_ztc_relation)+ apply (simp add: capRange_cap_relation obj_ref_of_relation[symmetric]) apply (rule valid_capAligned, rule ctes_of_valid) apply (simp add: cte_wp_at_ctes_of) apply clarsimp apply (drule cte_wp_at_norm, clarsimp) apply (drule(1) pspace_relation_ctes_ofI, clarsimp+) apply (simp add: is_cap_simps, elim disjE exE, simp_all add: isCap_simps)[1] apply clarsimp done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap\<rbrakk> \<Longrightarrow> corres dc (\<lambda>s. invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot s) invs' (set_cap cap slot) (updateCap (cte_map slot) cap') proof (prove)
goal (2 subgoals):
 1. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. \<exists>s. (invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot s) \<and> (s, s') \<in> state_relation \<and> invs' s') (updateCap (cte_map slot) cap')
 2. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap\<rbrakk> \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot s) \<and> invs' s' \<longrightarrow> (\<forall>(r', t')\<in>fst (updateCap (cte_map slot) cap' s'). \<exists>(r, t)\<in>fst (set_cap cap slot s). (t, t') \<in> state_relation \<and> dc r r') proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; True; \<exists>sa. (invs sa \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c sa \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot sa) \<and> (sa, s) \<in> state_relation \<and> invs' s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s
 2. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap\<rbrakk> \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot s) \<and> invs' s' \<longrightarrow> (\<forall>(r', t')\<in>fst (updateCap (cte_map slot) cap' s'). \<exists>(r, t)\<in>fst (set_cap cap slot s). (t, t') \<in> state_relation \<and> dc r r') proof (prove)
goal (2 subgoals):
 1. \<And>s sa. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; invs sa; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c sa \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot sa; (sa, s) \<in> state_relation; invs' s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s
 2. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap\<rbrakk> \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot s) \<and> invs' s' \<longrightarrow> (\<forall>(r', t')\<in>fst (updateCap (cte_map slot) cap' s'). \<exists>(r, t)\<in>fst (set_cap cap slot s). (t, t') \<in> state_relation \<and> dc r r') proof (prove)
goal (2 subgoals):
 1. \<And>s sa. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; invs sa; (sa, s) \<in> state_relation; invs' s; \<exists>c. cte_wp_at ((=) c) slot sa \<and> (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c sa \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s
 2. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap\<rbrakk> \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot s) \<and> invs' s' \<longrightarrow> (\<forall>(r', t')\<in>fst (updateCap (cte_map slot) cap' s'). \<exists>(r, t)\<in>fst (set_cap cap slot s). (t, t') \<in> state_relation \<and> dc r r') proof (prove)
goal (2 subgoals):
 1. \<And>s sa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; invs sa; invs' s; pspace_relation (kheap sa) (ksPSpace s); cte_wp_at ((=) c) slot sa; ekheap_relation (ekheap sa) (ksPSpace s); is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c; sched_act_relation (scheduler_action sa) (ksSchedulerAction s); is_final_cap' c sa; ready_queues_relation (ready_queues sa) (ksReadyQueues s); obj_ref_of c = obj_ref_of cap; obj_size c = obj_size cap; ghost_relation (kheap sa) (gsUserPages s) (gsCNodes s); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) sa) (cdt sa) (ctes_of s); cdt_list_relation (cdt_list sa) (cdt sa) (ctes_of s); revokable_relation (is_original_cap sa) (null_filter (caps_of_state sa)) (ctes_of s); (arch_state sa, ksArchState s) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node sa) (interrupt_states sa) (ksInterruptState s); cur_thread sa = ksCurThread s; idle_thread sa = ksIdleThread s; machine_state sa = ksMachineState s; work_units_completed sa = ksWorkUnitsCompleted s; domain_index sa = ksDomScheduleIdx s; domain_list sa = ksDomSchedule s; cur_domain sa = ksCurDomain s; domain_time sa = ksDomainTime s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s
 2. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap\<rbrakk> \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot s) \<and> invs' s' \<longrightarrow> (\<forall>(r', t')\<in>fst (updateCap (cte_map slot) cap' s'). \<exists>(r, t)\<in>fst (set_cap cap slot s). (t, t') \<in> state_relation \<and> dc r r') proof (prove)
goal (4 subgoals):
 1. \<And>s sa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; invs sa; invs' s; cte_wp_at ((=) c) slot sa; ekheap_relation (ekheap sa) (ksPSpace s); is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c; sched_act_relation (scheduler_action sa) (ksSchedulerAction s); is_final_cap' c sa; ready_queues_relation (ready_queues sa) (ksReadyQueues s); obj_ref_of c = obj_ref_of cap; obj_size c = obj_size cap; ghost_relation (kheap sa) (gsUserPages s) (gsCNodes s); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) sa) (cdt sa) (ctes_of s); cdt_list_relation (cdt_list sa) (cdt sa) (ctes_of s); revokable_relation (is_original_cap sa) (null_filter (caps_of_state sa)) (ctes_of s); (arch_state sa, ksArchState s) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node sa) (interrupt_states sa) (ksInterruptState s); cur_thread sa = ksCurThread s; idle_thread sa = ksIdleThread s; machine_state sa = ksMachineState s; work_units_completed sa = ksWorkUnitsCompleted s; domain_index sa = ksDomScheduleIdx s; domain_list sa = ksDomSchedule s; cur_domain sa = ksCurDomain s; domain_time sa = ksDomainTime s\<rbrakk> \<Longrightarrow> pspace_aligned' s
 2. \<And>s sa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; invs sa; invs' s; cte_wp_at ((=) c) slot sa; ekheap_relation (ekheap sa) (ksPSpace s); is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c; sched_act_relation (scheduler_action sa) (ksSchedulerAction s); is_final_cap' c sa; ready_queues_relation (ready_queues sa) (ksReadyQueues s); obj_ref_of c = obj_ref_of cap; obj_size c = obj_size cap; ghost_relation (kheap sa) (gsUserPages s) (gsCNodes s); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) sa) (cdt sa) (ctes_of s); cdt_list_relation (cdt_list sa) (cdt sa) (ctes_of s); revokable_relation (is_original_cap sa) (null_filter (caps_of_state sa)) (ctes_of s); (arch_state sa, ksArchState s) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node sa) (interrupt_states sa) (ksInterruptState s); cur_thread sa = ksCurThread s; idle_thread sa = ksIdleThread s; machine_state sa = ksMachineState s; work_units_completed sa = ksWorkUnitsCompleted s; domain_index sa = ksDomScheduleIdx s; domain_list sa = ksDomSchedule s; cur_domain sa = ksCurDomain s; domain_time sa = ksDomainTime s\<rbrakk> \<Longrightarrow> pspace_distinct' s
 3. \<And>s sa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; invs sa; invs' s; cte_wp_at ((=) c) slot sa; ekheap_relation (ekheap sa) (ksPSpace s); is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c; sched_act_relation (scheduler_action sa) (ksSchedulerAction s); is_final_cap' c sa; ready_queues_relation (ready_queues sa) (ksReadyQueues s); obj_ref_of c = obj_ref_of cap; obj_size c = obj_size cap; ghost_relation (kheap sa) (gsUserPages s) (gsCNodes s); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) sa) (cdt sa) (ctes_of s); cdt_list_relation (cdt_list sa) (cdt sa) (ctes_of s); revokable_relation (is_original_cap sa) (null_filter (caps_of_state sa)) (ctes_of s); (arch_state sa, ksArchState s) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node sa) (interrupt_states sa) (ksInterruptState s); cur_thread sa = ksCurThread s; idle_thread sa = ksIdleThread s; machine_state sa = ksMachineState s; work_units_completed sa = ksWorkUnitsCompleted s; domain_index sa = ksDomScheduleIdx s; domain_list sa = ksDomSchedule s; cur_domain sa = ksCurDomain s; domain_time sa = ksDomainTime s; \<exists>cte. ctes_of s (cte_map slot) = Some cte \<and> cap_relation c (cteCap cte)\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s
 4. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap\<rbrakk> \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot s) \<and> invs' s' \<longrightarrow> (\<forall>(r', t')\<in>fst (updateCap (cte_map slot) cap' s'). \<exists>(r, t)\<in>fst (set_cap cap slot s). (t, t') \<in> state_relation \<and> dc r r') proof (prove)
goal (3 subgoals):
 1. \<And>s sa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; invs sa; invs' s; cte_wp_at ((=) c) slot sa; ekheap_relation (ekheap sa) (ksPSpace s); is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c; sched_act_relation (scheduler_action sa) (ksSchedulerAction s); is_final_cap' c sa; ready_queues_relation (ready_queues sa) (ksReadyQueues s); obj_ref_of c = obj_ref_of cap; obj_size c = obj_size cap; ghost_relation (kheap sa) (gsUserPages s) (gsCNodes s); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) sa) (cdt sa) (ctes_of s); cdt_list_relation (cdt_list sa) (cdt sa) (ctes_of s); revokable_relation (is_original_cap sa) (null_filter (caps_of_state sa)) (ctes_of s); (arch_state sa, ksArchState s) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node sa) (interrupt_states sa) (ksInterruptState s); cur_thread sa = ksCurThread s; idle_thread sa = ksIdleThread s; machine_state sa = ksMachineState s; work_units_completed sa = ksWorkUnitsCompleted s; domain_index sa = ksDomScheduleIdx s; domain_list sa = ksDomSchedule s; cur_domain sa = ksCurDomain s; domain_time sa = ksDomainTime s\<rbrakk> \<Longrightarrow> pspace_distinct' s
 2. \<And>s sa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; invs sa; invs' s; cte_wp_at ((=) c) slot sa; ekheap_relation (ekheap sa) (ksPSpace s); is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c; sched_act_relation (scheduler_action sa) (ksSchedulerAction s); is_final_cap' c sa; ready_queues_relation (ready_queues sa) (ksReadyQueues s); obj_ref_of c = obj_ref_of cap; obj_size c = obj_size cap; ghost_relation (kheap sa) (gsUserPages s) (gsCNodes s); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) sa) (cdt sa) (ctes_of s); cdt_list_relation (cdt_list sa) (cdt sa) (ctes_of s); revokable_relation (is_original_cap sa) (null_filter (caps_of_state sa)) (ctes_of s); (arch_state sa, ksArchState s) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node sa) (interrupt_states sa) (ksInterruptState s); cur_thread sa = ksCurThread s; idle_thread sa = ksIdleThread s; machine_state sa = ksMachineState s; work_units_completed sa = ksWorkUnitsCompleted s; domain_index sa = ksDomScheduleIdx s; domain_list sa = ksDomSchedule s; cur_domain sa = ksCurDomain s; domain_time sa = ksDomainTime s; \<exists>cte. ctes_of s (cte_map slot) = Some cte \<and> cap_relation c (cteCap cte)\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s
 3. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap\<rbrakk> \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot s) \<and> invs' s' \<longrightarrow> (\<forall>(r', t')\<in>fst (updateCap (cte_map slot) cap' s'). \<exists>(r, t)\<in>fst (set_cap cap slot s). (t, t') \<in> state_relation \<and> dc r r') proof (prove)
goal (2 subgoals):
 1. \<And>s sa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; invs sa; invs' s; cte_wp_at ((=) c) slot sa; ekheap_relation (ekheap sa) (ksPSpace s); is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c; sched_act_relation (scheduler_action sa) (ksSchedulerAction s); is_final_cap' c sa; ready_queues_relation (ready_queues sa) (ksReadyQueues s); obj_ref_of c = obj_ref_of cap; obj_size c = obj_size cap; ghost_relation (kheap sa) (gsUserPages s) (gsCNodes s); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) sa) (cdt sa) (ctes_of s); cdt_list_relation (cdt_list sa) (cdt sa) (ctes_of s); revokable_relation (is_original_cap sa) (null_filter (caps_of_state sa)) (ctes_of s); (arch_state sa, ksArchState s) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node sa) (interrupt_states sa) (ksInterruptState s); cur_thread sa = ksCurThread s; idle_thread sa = ksIdleThread s; machine_state sa = ksMachineState s; work_units_completed sa = ksWorkUnitsCompleted s; domain_index sa = ksDomScheduleIdx s; domain_list sa = ksDomSchedule s; cur_domain sa = ksCurDomain s; domain_time sa = ksDomainTime s; \<exists>cte. ctes_of s (cte_map slot) = Some cte \<and> cap_relation c (cteCap cte)\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s
 2. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap\<rbrakk> \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot s) \<and> invs' s' \<longrightarrow> (\<forall>(r', t')\<in>fst (updateCap (cte_map slot) cap' s'). \<exists>(r, t)\<in>fst (set_cap cap slot s). (t, t') \<in> state_relation \<and> dc r r') proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap\<rbrakk> \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (invs s \<and> cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c s \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot s) \<and> invs' s' \<longrightarrow> (\<forall>(r', t')\<in>fst (updateCap (cte_map slot) cap' s'). \<exists>(r, t)\<in>fst (set_cap cap slot s). (t, t') \<in> state_relation \<and> dc r r') proof (prove)
goal (1 subgoal):
 1. \<And>a b ba. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ((), ba) \<in> fst (updateCap (cte_map slot) cap' b); invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap cap slot a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>a b ba. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ((), ba) \<in> fst (updateCap (cte_map slot) cap' b); invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relations (ekheap a) (kheap a) (ksPSpace b)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap cap slot a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (2 subgoals):
 1. \<And>a b ba. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ((), ba) \<in> fst (updateCap (cte_map slot) cap' b); invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relations (ekheap a) (kheap a) (ksPSpace b)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot a
 2. \<And>a b ba. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ((), ba) \<in> fst (updateCap (cte_map slot) cap' b); invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relations (ekheap a) (kheap a) (ksPSpace b); \<exists>t. ((), t) \<in> fst (set_cap cap slot a) \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace ba) \<and> cdt t = cdt a \<and> cdt_list t = cdt_list a \<and> ekheap t = ekheap a \<and> scheduler_action t = scheduler_action a \<and> ready_queues t = ready_queues a \<and> is_original_cap t = is_original_cap a \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap cap slot a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>a b ba. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ((), ba) \<in> fst (updateCap (cte_map slot) cap' b); invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relations (ekheap a) (kheap a) (ksPSpace b); \<exists>t. ((), t) \<in> fst (set_cap cap slot a) \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace ba) \<and> cdt t = cdt a \<and> cdt_list t = cdt_list a \<and> ekheap t = ekheap a \<and> scheduler_action t = scheduler_action a \<and> ready_queues t = ready_queues a \<and> is_original_cap t = is_original_cap a \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap cap slot a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>a b ba t. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ((), ba) \<in> fst (updateCap (cte_map slot) cap' b); invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relations (ekheap a) (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace ba); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState ba) \<in> arch_state_relation; cur_thread t = ksCurThread ba; idle_thread t = ksIdleThread ba; machine_state t = ksMachineState ba; work_units_completed t = ksWorkUnitsCompleted ba; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap cap slot a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (2 subgoals):
 1. \<And>a b ba t. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ((), ba) \<in> fst (updateCap (cte_map slot) cap' b); invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relations (ekheap a) (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace ba); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState ba) \<in> arch_state_relation; cur_thread t = ksCurThread ba; idle_thread t = ksIdleThread ba; machine_state t = ksMachineState ba; work_units_completed t = ksWorkUnitsCompleted ba; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba\<rbrakk> \<Longrightarrow> case ?x174 a b ba t of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 2. \<And>a b ba t. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ((), ba) \<in> fst (updateCap (cte_map slot) cap' b); invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relations (ekheap a) (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace ba); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState ba) \<in> arch_state_relation; cur_thread t = ksCurThread ba; idle_thread t = ksIdleThread ba; machine_state t = ksMachineState ba; work_units_completed t = ksWorkUnitsCompleted ba; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba\<rbrakk> \<Longrightarrow> ?x174 a b ba t \<in> fst (set_cap cap slot a) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba t. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ((), ba) \<in> fst (updateCap (cte_map slot) cap' b); invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relations (ekheap a) (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace ba); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState ba) \<in> arch_state_relation; cur_thread t = ksCurThread ba; idle_thread t = ksIdleThread ba; machine_state t = ksMachineState ba; work_units_completed t = ksWorkUnitsCompleted ba; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba\<rbrakk> \<Longrightarrow> ?x174 a b ba t \<in> fst (set_cap cap slot a)
 2. \<And>a b ba t. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ((), ba) \<in> fst (updateCap (cte_map slot) cap' b); invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relations (ekheap a) (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace ba); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState ba) \<in> arch_state_relation; cur_thread t = ksCurThread ba; idle_thread t = ksIdleThread ba; machine_state t = ksMachineState ba; work_units_completed t = ksWorkUnitsCompleted ba; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba\<rbrakk> \<Longrightarrow> case ?x174 a b ba t of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>a b ba t. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ((), ba) \<in> fst (updateCap (cte_map slot) cap' b); invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relations (ekheap a) (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace ba); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState ba) \<in> arch_state_relation; cur_thread t = ksCurThread ba; idle_thread t = ksIdleThread ba; machine_state t = ksMachineState ba; work_units_completed t = ksWorkUnitsCompleted ba; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba\<rbrakk> \<Longrightarrow> case ((), t) of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>a b ba t. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ((), ba) \<in> fst (updateCap (cte_map slot) cap' b); invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState ba) \<in> arch_state_relation; cur_thread t = ksCurThread ba; idle_thread t = ksIdleThread ba; machine_state t = ksMachineState ba; work_units_completed t = ksWorkUnitsCompleted ba; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action a) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues a) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of ba) \<and> cdt_list_relation (cdt_list a) (cdt a) (ctes_of ba) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state t)) (ctes_of ba) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba t. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState ba) \<in> arch_state_relation; cur_thread t = ksCurThread ba; idle_thread t = ksIdleThread ba; machine_state t = ksMachineState ba; work_units_completed t = ksWorkUnitsCompleted ba; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (K cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba)\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action a) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues a) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of ba) \<and> cdt_list_relation (cdt_list a) (cdt a) (ctes_of ba) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state t)) (ctes_of ba) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba t. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba)\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap'))) \<and> cdt_list_relation (cdt_list a) (cdt a) (modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap'))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state t)) (modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap'))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba t. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba)\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b)
 2. \<And>a b ba t. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap'))) \<and> cdt_list_relation (cdt_list a) (cdt a) (modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap'))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state t)) (modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap'))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba t. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap'))) \<and> cdt_list_relation (cdt_list a) (cdt a) (modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap'))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state t)) (modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap'))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba t. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')))
 2. \<And>a b ba t. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba)\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list a) (cdt a) (modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap'))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state t)) (modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap'))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba t. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba)\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list a) (cdt a) (modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap'))) \<and> revokable_relation (is_original_cap a) (null_filter (caps_of_state t)) (modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')))
 2. \<And>a b ba t. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap'))) proof (prove)
goal (3 subgoals):
 1. \<And>a b ba t. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba)\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list a) (cdt a) (modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')))
 2. \<And>a b ba t. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba)\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap a) (null_filter (caps_of_state t)) (modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')))
 3. \<And>a b ba t. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap'))) proof (prove)
goal (3 subgoals):
 1. \<And>a b ba t. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>c cap node. ctes_of b (cte_map c) = Some (CTE cap node) \<longrightarrow> (case next_slot c (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba)\<rbrakk> \<Longrightarrow> \<forall>c cap node. modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) (cte_map c) = Some (CTE cap node) \<longrightarrow> (case next_slot c (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next)
 2. \<And>a b ba t. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba)\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap a) (null_filter (caps_of_state t)) (modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')))
 3. \<And>a b ba t. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap'))) proof (prove)
goal (3 subgoals):
 1. \<And>a b ba t c capa node. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>c cap node. ctes_of b (cte_map c) = Some (CTE cap node) \<longrightarrow> (case next_slot c (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) (cte_map c) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> case next_slot c (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>a b ba t. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba)\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap a) (null_filter (caps_of_state t)) (modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')))
 3. \<And>a b ba t. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap'))) proof (prove)
goal (3 subgoals):
 1. \<And>a b ba t c capa node. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) (cte_map c) = Some (CTE capa node); \<forall>cap node. ctes_of b (cte_map c) = Some (CTE cap node) \<longrightarrow> (case next_slot c (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next)\<rbrakk> \<Longrightarrow> case next_slot c (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>a b ba t. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba)\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap a) (null_filter (caps_of_state t)) (modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')))
 3. \<And>a b ba t. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap'))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba t. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba)\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap a) (null_filter (caps_of_state t)) (modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')))
 2. \<And>a b ba t. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap'))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba t. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>c cap node. null_filter (caps_of_state a) c \<noteq> None \<longrightarrow> ctes_of b (cte_map c) = Some (CTE cap node) \<longrightarrow> is_original_cap a c = mdbRevocable node; (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba)\<rbrakk> \<Longrightarrow> \<forall>c cap node. null_filter (caps_of_state t) c \<noteq> None \<longrightarrow> modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) (cte_map c) = Some (CTE cap node) \<longrightarrow> is_original_cap a c = mdbRevocable node
 2. \<And>a b ba t. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap'))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba t. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>c cap node. null_filter (caps_of_state a) c \<noteq> None \<longrightarrow> ctes_of b (cte_map c) = Some (CTE cap node) \<longrightarrow> is_original_cap a c = mdbRevocable node; (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap)\<rbrakk> \<Longrightarrow> \<forall>c cap node. null_filter (caps_of_state t) c \<noteq> None \<longrightarrow> modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) (cte_map c) = Some (CTE cap node) \<longrightarrow> is_original_cap a c = mdbRevocable node
 2. \<And>a b ba t. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap'))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba t. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>c. (\<exists>y. null_filter (caps_of_state a) c = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map c) = Some (CTE cap node) \<longrightarrow> is_original_cap a c = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; \<exists>capa. caps_of_state a slot = Some capa \<and> (is_zombie capa \<or> is_cnode_cap capa \<or> is_thread_cap capa) \<and> is_final_cap' capa a \<and> obj_ref_of capa = obj_ref_of cap \<and> obj_size capa = obj_size cap; invs' b; pspace_relation (kheap a) (ksPSpace b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap)\<rbrakk> \<Longrightarrow> \<forall>c. (\<exists>y. null_filter ((caps_of_state a)(slot \<mapsto> cap)) c = Some y) \<longrightarrow> (\<forall>cap node. modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) (cte_map c) = Some (CTE cap node) \<longrightarrow> is_original_cap a c = mdbRevocable node)
 2. \<And>a b ba t. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap'))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba t c capa node. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>c. (\<exists>y. null_filter (caps_of_state a) c = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map c) = Some (CTE cap node) \<longrightarrow> is_original_cap a c = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; \<exists>capa. caps_of_state a slot = Some capa \<and> (is_zombie capa \<or> is_cnode_cap capa \<or> is_thread_cap capa) \<and> is_final_cap' capa a \<and> obj_ref_of capa = obj_ref_of cap \<and> obj_size capa = obj_size cap; invs' b; pspace_relation (kheap a) (ksPSpace b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); \<exists>y. null_filter ((caps_of_state a)(slot \<mapsto> cap)) c = Some y; modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) (cte_map c) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> is_original_cap a c = mdbRevocable node
 2. \<And>a b ba t. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap'))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba t c capa node. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; \<exists>capa. caps_of_state a slot = Some capa \<and> (is_zombie capa \<or> is_cnode_cap capa \<or> is_thread_cap capa) \<and> is_final_cap' capa a \<and> obj_ref_of capa = obj_ref_of cap \<and> obj_size capa = obj_size cap; invs' b; pspace_relation (kheap a) (ksPSpace b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); \<exists>y. null_filter ((caps_of_state a)(slot \<mapsto> cap)) c = Some y; modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) (cte_map c) = Some (CTE capa node); (\<exists>y. null_filter (caps_of_state a) c = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map c) = Some (CTE cap node) \<longrightarrow> is_original_cap a c = mdbRevocable node)\<rbrakk> \<Longrightarrow> is_original_cap a c = mdbRevocable node
 2. \<And>a b ba t. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap'))) proof (prove)
goal (3 subgoals):
 1. \<And>a b ba t c capa node. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; \<exists>capa. caps_of_state a slot = Some capa \<and> (is_zombie capa \<or> is_cnode_cap capa \<or> is_thread_cap capa) \<and> is_final_cap' capa a \<and> obj_ref_of capa = obj_ref_of cap \<and> obj_size capa = obj_size cap; invs' b; pspace_relation (kheap a) (ksPSpace b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); \<exists>y. null_filter ((caps_of_state a)(slot \<mapsto> cap)) c = Some y; modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) (cte_map c) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> \<exists>y. null_filter (caps_of_state a) c = Some y
 2. \<And>a b ba t c capa node. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; \<exists>capa. caps_of_state a slot = Some capa \<and> (is_zombie capa \<or> is_cnode_cap capa \<or> is_thread_cap capa) \<and> is_final_cap' capa a \<and> obj_ref_of capa = obj_ref_of cap \<and> obj_size capa = obj_size cap; invs' b; pspace_relation (kheap a) (ksPSpace b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); \<exists>y. null_filter ((caps_of_state a)(slot \<mapsto> cap)) c = Some y; modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) (cte_map c) = Some (CTE capa node); \<forall>cap node. ctes_of b (cte_map c) = Some (CTE cap node) \<longrightarrow> is_original_cap a c = mdbRevocable node\<rbrakk> \<Longrightarrow> is_original_cap a c = mdbRevocable node
 3. \<And>a b ba t. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap'))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba t c capa node. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; \<exists>capa. caps_of_state a slot = Some capa \<and> (is_zombie capa \<or> is_cnode_cap capa \<or> is_thread_cap capa) \<and> is_final_cap' capa a \<and> obj_ref_of capa = obj_ref_of cap \<and> obj_size capa = obj_size cap; invs' b; pspace_relation (kheap a) (ksPSpace b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); \<exists>y. null_filter ((caps_of_state a)(slot \<mapsto> cap)) c = Some y; modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) (cte_map c) = Some (CTE capa node); \<forall>cap node. ctes_of b (cte_map c) = Some (CTE cap node) \<longrightarrow> is_original_cap a c = mdbRevocable node\<rbrakk> \<Longrightarrow> is_original_cap a c = mdbRevocable node
 2. \<And>a b ba t. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap'))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba t. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap'))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba t. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = None\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')))
 2. \<And>a b ba t aa. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap'))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba t aa. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap')) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (modify_map (ctes_of b) (cte_map slot) (cteCap_update (\<lambda>y. cap'))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba t aa. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) ((ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa)) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba t aa. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa\<rbrakk> \<Longrightarrow> \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> descendants_of' (cte_map c) (ctes_of b) = descendants_of' (cte_map c) ((ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa)) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> descendants_of' (cte_map c) (ctes_of b) = descendants_of' (cte_map c) ((ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa)) proof (prove)
goal (8 subgoals):
 1. \<And>a b ba t aa c x. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a; ctes_of b \<turnstile> x \<rightarrow> cte_map slot; \<not> True\<rbrakk> \<Longrightarrow> \<exists>cte'. ctes_of b x = Some cte' \<and> capMasterCap (cteCap cte') \<noteq> capMasterCap (cteCap aa) \<and> global.sameRegionAs (cteCap cte') (cteCap aa)
 2. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> ctes_of b (cte_map slot) = Some aa
 3. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> isZombie cap' \<or> isCNodeCap cap' \<or> isThreadCap cap'
 4. \<And>a b ba t aa c x cte'. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a; ctes_of b x = Some cte'; x \<noteq> cte_map slot; True\<rbrakk> \<Longrightarrow> isUntypedCap (cteCap cte') \<or> capClass (cteCap cte') \<noteq> PhysicalClass \<or> global.capUntypedPtr (cteCap cte') \<noteq> global.capUntypedPtr (cteCap aa)
 5. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> capRange (cteCap aa) = capRange cap' \<and> global.capUntypedPtr (cteCap aa) = global.capUntypedPtr cap'
 6. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> capAligned (cteCap aa)
 7. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> isZombie (cteCap aa) \<or> isCNodeCap (cteCap aa) \<or> isThreadCap (cteCap aa)
 8. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> no_loops (ctes_of b) proof (prove)
goal (7 subgoals):
 1. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> ctes_of b (cte_map slot) = Some aa
 2. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> isZombie cap' \<or> isCNodeCap cap' \<or> isThreadCap cap'
 3. \<And>a b ba t aa c x cte'. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a; ctes_of b x = Some cte'; x \<noteq> cte_map slot; True\<rbrakk> \<Longrightarrow> isUntypedCap (cteCap cte') \<or> capClass (cteCap cte') \<noteq> PhysicalClass \<or> global.capUntypedPtr (cteCap cte') \<noteq> global.capUntypedPtr (cteCap aa)
 4. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> capRange (cteCap aa) = capRange cap' \<and> global.capUntypedPtr (cteCap aa) = global.capUntypedPtr cap'
 5. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> capAligned (cteCap aa)
 6. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> isZombie (cteCap aa) \<or> isCNodeCap (cteCap aa) \<or> isThreadCap (cteCap aa)
 7. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> no_loops (ctes_of b) proof (prove)
goal (6 subgoals):
 1. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> isZombie cap' \<or> isCNodeCap cap' \<or> isThreadCap cap'
 2. \<And>a b ba t aa c x cte'. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a; ctes_of b x = Some cte'; x \<noteq> cte_map slot; True\<rbrakk> \<Longrightarrow> isUntypedCap (cteCap cte') \<or> capClass (cteCap cte') \<noteq> PhysicalClass \<or> global.capUntypedPtr (cteCap cte') \<noteq> global.capUntypedPtr (cteCap aa)
 3. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> capRange (cteCap aa) = capRange cap' \<and> global.capUntypedPtr (cteCap aa) = global.capUntypedPtr cap'
 4. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> capAligned (cteCap aa)
 5. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> isZombie (cteCap aa) \<or> isCNodeCap (cteCap aa) \<or> isThreadCap (cteCap aa)
 6. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> no_loops (ctes_of b) proof (prove)
goal (5 subgoals):
 1. \<And>a b ba t aa c x cte'. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a; ctes_of b x = Some cte'; x \<noteq> cte_map slot; True\<rbrakk> \<Longrightarrow> isUntypedCap (cteCap cte') \<or> capClass (cteCap cte') \<noteq> PhysicalClass \<or> global.capUntypedPtr (cteCap cte') \<noteq> global.capUntypedPtr (cteCap aa)
 2. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> capRange (cteCap aa) = capRange cap' \<and> global.capUntypedPtr (cteCap aa) = global.capUntypedPtr cap'
 3. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> capAligned (cteCap aa)
 4. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> isZombie (cteCap aa) \<or> isCNodeCap (cteCap aa) \<or> isThreadCap (cteCap aa)
 5. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> no_loops (ctes_of b) proof (prove)
goal (6 subgoals):
 1. \<And>a b ba t aa ab bb x cte'. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) (ab, bb) a; ctes_of b x = Some cte'; x \<noteq> cte_map slot; ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa); gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; ksMachineState ba = ksMachineState b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksCurThread ba = ksCurThread b; ksIdleThread ba = ksIdleThread b; ksReadyQueues ba = ksReadyQueues b; ksSchedulerAction ba = ksSchedulerAction b; ksArchState ba = ksArchState b; pspace_aligned' b \<longrightarrow> pspace_aligned' ba; pspace_distinct' b \<longrightarrow> pspace_distinct' ba\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>cap. is_final_cap' cap a \<and> obj_refs cap \<noteq> {}) slot a
 2. \<And>a b ba t aa c x cte'. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a; ctes_of b x = Some cte'; x \<noteq> cte_map slot; True; capClass (cteCap cte') \<noteq> PhysicalClass \<or> isUntypedCap (cteCap cte') \<or> global.capUntypedPtr (cteCap aa) \<noteq> global.capUntypedPtr (cteCap cte')\<rbrakk> \<Longrightarrow> isUntypedCap (cteCap cte') \<or> capClass (cteCap cte') \<noteq> PhysicalClass \<or> global.capUntypedPtr (cteCap cte') \<noteq> global.capUntypedPtr (cteCap aa)
 3. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> capRange (cteCap aa) = capRange cap' \<and> global.capUntypedPtr (cteCap aa) = global.capUntypedPtr cap'
 4. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> capAligned (cteCap aa)
 5. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> isZombie (cteCap aa) \<or> isCNodeCap (cteCap aa) \<or> isThreadCap (cteCap aa)
 6. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> no_loops (ctes_of b) proof (prove)
goal (6 subgoals):
 1. \<And>a b ba t aa ab bb x cte' capa capaa. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. (\<exists>cap. caps_of_state a (aa, ba) = Some cap) \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of b (cte_map slot) = Some aa; ctes_of b x = Some cte'; x \<noteq> cte_map slot; ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa); gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; ksMachineState ba = ksMachineState b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksCurThread ba = ksCurThread b; ksIdleThread ba = ksIdleThread b; ksReadyQueues ba = ksReadyQueues b; ksSchedulerAction ba = ksSchedulerAction b; ksArchState ba = ksArchState b; pspace_aligned' b \<longrightarrow> pspace_aligned' ba; pspace_distinct' b \<longrightarrow> pspace_distinct' ba; caps_of_state a (ab, bb) = Some capaa; caps_of_state a slot = Some capa; is_zombie capa \<or> is_cnode_cap capa \<or> is_thread_cap capa; is_final_cap' capa a; obj_ref_of capa = obj_ref_of cap; obj_size capa = obj_size cap; obj_refs capa = {}\<rbrakk> \<Longrightarrow> False
 2. \<And>a b ba t aa c x cte'. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a; ctes_of b x = Some cte'; x \<noteq> cte_map slot; True; capClass (cteCap cte') \<noteq> PhysicalClass \<or> isUntypedCap (cteCap cte') \<or> global.capUntypedPtr (cteCap aa) \<noteq> global.capUntypedPtr (cteCap cte')\<rbrakk> \<Longrightarrow> isUntypedCap (cteCap cte') \<or> capClass (cteCap cte') \<noteq> PhysicalClass \<or> global.capUntypedPtr (cteCap cte') \<noteq> global.capUntypedPtr (cteCap aa)
 3. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> capRange (cteCap aa) = capRange cap' \<and> global.capUntypedPtr (cteCap aa) = global.capUntypedPtr cap'
 4. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> capAligned (cteCap aa)
 5. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> isZombie (cteCap aa) \<or> isCNodeCap (cteCap aa) \<or> isThreadCap (cteCap aa)
 6. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> no_loops (ctes_of b) proof (prove)
goal (5 subgoals):
 1. \<And>a b ba t aa c x cte'. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a; ctes_of b x = Some cte'; x \<noteq> cte_map slot; True; capClass (cteCap cte') \<noteq> PhysicalClass \<or> isUntypedCap (cteCap cte') \<or> global.capUntypedPtr (cteCap aa) \<noteq> global.capUntypedPtr (cteCap cte')\<rbrakk> \<Longrightarrow> isUntypedCap (cteCap cte') \<or> capClass (cteCap cte') \<noteq> PhysicalClass \<or> global.capUntypedPtr (cteCap cte') \<noteq> global.capUntypedPtr (cteCap aa)
 2. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> capRange (cteCap aa) = capRange cap' \<and> global.capUntypedPtr (cteCap aa) = global.capUntypedPtr cap'
 3. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> capAligned (cteCap aa)
 4. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> isZombie (cteCap aa) \<or> isCNodeCap (cteCap aa) \<or> isThreadCap (cteCap aa)
 5. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> no_loops (ctes_of b) proof (prove)
goal (4 subgoals):
 1. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> capRange (cteCap aa) = capRange cap' \<and> global.capUntypedPtr (cteCap aa) = global.capUntypedPtr cap'
 2. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> capAligned (cteCap aa)
 3. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> isZombie (cteCap aa) \<or> isCNodeCap (cteCap aa) \<or> isThreadCap (cteCap aa)
 4. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> no_loops (ctes_of b) proof (prove)
goal (4 subgoals):
 1. \<And>a b ba t aa ab bb c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) (ab, bb) a; ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa); cte_wp_at ((=) c) slot a; gsUserPages ba = gsUserPages b; is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c; gsCNodes ba = gsCNodes b; is_final_cap' c a; ksMachineState ba = ksMachineState b; obj_ref_of c = obj_ref_of cap; obj_size c = obj_size cap; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksCurThread ba = ksCurThread b; ksIdleThread ba = ksIdleThread b; ksReadyQueues ba = ksReadyQueues b; ksSchedulerAction ba = ksSchedulerAction b; ksArchState ba = ksArchState b; pspace_aligned' b \<longrightarrow> pspace_aligned' ba; pspace_distinct' b \<longrightarrow> pspace_distinct' ba\<rbrakk> \<Longrightarrow> capRange (cteCap aa) = capRange cap' \<and> global.capUntypedPtr (cteCap aa) = global.capUntypedPtr cap'
 2. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> capAligned (cteCap aa)
 3. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> isZombie (cteCap aa) \<or> isCNodeCap (cteCap aa) \<or> isThreadCap (cteCap aa)
 4. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> no_loops (ctes_of b) proof (prove)
goal (4 subgoals):
 1. \<And>a b ba t aa ab bb c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; invs' b; ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) (ab, bb) a; ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa); cte_wp_at ((=) c) slot a; gsUserPages ba = gsUserPages b; is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c; gsCNodes ba = gsCNodes b; is_final_cap' c a; ksMachineState ba = ksMachineState b; obj_ref_of c = obj_ref_of cap; obj_size c = obj_size cap; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksCurThread ba = ksCurThread b; ksIdleThread ba = ksIdleThread b; ksReadyQueues ba = ksReadyQueues b; ksSchedulerAction ba = ksSchedulerAction b; ksArchState ba = ksArchState b; pspace_aligned' b \<longrightarrow> pspace_aligned' ba; pspace_distinct' b \<longrightarrow> pspace_distinct' ba; cap_relation c (cteCap aa)\<rbrakk> \<Longrightarrow> capRange (cteCap aa) = capRange cap' \<and> global.capUntypedPtr (cteCap aa) = global.capUntypedPtr cap'
 2. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> capAligned (cteCap aa)
 3. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> isZombie (cteCap aa) \<or> isCNodeCap (cteCap aa) \<or> isThreadCap (cteCap aa)
 4. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> no_loops (ctes_of b) proof (prove)
goal (4 subgoals):
 1. \<And>a b ba t aa ab bb c. \<lbrakk>cap_relation cap cap'; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; invs' b; ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) (ab, bb) a; ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa); cte_wp_at ((=) c) slot a; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; is_final_cap' c a; ksMachineState ba = ksMachineState b; obj_ref_of c = obj_ref_of cap; obj_size c = obj_size cap; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksCurThread ba = ksCurThread b; ksIdleThread ba = ksIdleThread b; ksReadyQueues ba = ksReadyQueues b; ksSchedulerAction ba = ksSchedulerAction b; ksArchState ba = ksArchState b; pspace_aligned' b \<longrightarrow> pspace_aligned' ba; pspace_distinct' b \<longrightarrow> pspace_distinct' ba; cap_relation c (cteCap aa); capClass cap' = PhysicalClass; capClass (cteCap aa) = PhysicalClass\<rbrakk> \<Longrightarrow> capRange (cteCap aa) = capRange cap' \<and> global.capUntypedPtr (cteCap aa) = global.capUntypedPtr cap'
 2. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> capAligned (cteCap aa)
 3. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> isZombie (cteCap aa) \<or> isCNodeCap (cteCap aa) \<or> isThreadCap (cteCap aa)
 4. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> no_loops (ctes_of b) proof (prove)
goal (3 subgoals):
 1. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> capAligned (cteCap aa)
 2. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> isZombie (cteCap aa) \<or> isCNodeCap (cteCap aa) \<or> isThreadCap (cteCap aa)
 3. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> no_loops (ctes_of b) proof (prove)
goal (4 subgoals):
 1. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> cte_wp_at' ((=) aa) (?p751 a b ba t aa c) (?s749 a b ba t aa c)
 2. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> valid_objs' (?s749 a b ba t aa c)
 3. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> isZombie (cteCap aa) \<or> isCNodeCap (cteCap aa) \<or> isThreadCap (cteCap aa)
 4. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> no_loops (ctes_of b) proof (prove)
goal (3 subgoals):
 1. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> valid_objs' b
 2. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> isZombie (cteCap aa) \<or> isCNodeCap (cteCap aa) \<or> isThreadCap (cteCap aa)
 3. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> no_loops (ctes_of b) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> isZombie (cteCap aa) \<or> isCNodeCap (cteCap aa) \<or> isThreadCap (cteCap aa)
 2. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> no_loops (ctes_of b) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba t aa ab bb c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) (ab, bb) a; ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa); cte_wp_at ((=) c) slot a; gsUserPages ba = gsUserPages b; is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c; gsCNodes ba = gsCNodes b; is_final_cap' c a; ksMachineState ba = ksMachineState b; obj_ref_of c = obj_ref_of cap; obj_size c = obj_size cap; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksCurThread ba = ksCurThread b; ksIdleThread ba = ksIdleThread b; ksReadyQueues ba = ksReadyQueues b; ksSchedulerAction ba = ksSchedulerAction b; ksArchState ba = ksArchState b; pspace_aligned' b \<longrightarrow> pspace_aligned' ba; pspace_distinct' b \<longrightarrow> pspace_distinct' ba; \<not> isZombie (cteCap aa); \<not> isThreadCap (cteCap aa)\<rbrakk> \<Longrightarrow> isCNodeCap (cteCap aa)
 2. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> no_loops (ctes_of b) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba t aa ab bb c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; invs' b; ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) (ab, bb) a; ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa); cte_wp_at ((=) c) slot a; gsUserPages ba = gsUserPages b; is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c; gsCNodes ba = gsCNodes b; is_final_cap' c a; ksMachineState ba = ksMachineState b; obj_ref_of c = obj_ref_of cap; obj_size c = obj_size cap; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksCurThread ba = ksCurThread b; ksIdleThread ba = ksIdleThread b; ksReadyQueues ba = ksReadyQueues b; ksSchedulerAction ba = ksSchedulerAction b; ksArchState ba = ksArchState b; pspace_aligned' b \<longrightarrow> pspace_aligned' ba; pspace_distinct' b \<longrightarrow> pspace_distinct' ba; \<not> isZombie (cteCap aa); \<not> isThreadCap (cteCap aa); cap_relation c (cteCap aa)\<rbrakk> \<Longrightarrow> is_cnode_cap c
 2. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> no_loops (ctes_of b) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba t aa c. \<lbrakk>cap_relation cap cap'; is_zombie cap \<or> is_cnode_cap cap \<or> is_thread_cap cap; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>c. cte_wp_at (\<lambda>_. True) c a \<longrightarrow> cte_map ` descendants_of c (cdt a) = descendants_of' (cte_map c) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; invs a; cte_wp_at (\<lambda>c. (is_zombie c \<or> is_cnode_cap c \<or> is_thread_cap c) \<and> is_final_cap' c a \<and> obj_ref_of c = obj_ref_of cap \<and> obj_size c = obj_size cap) slot a; invs' b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx ba; domain_list t = ksDomSchedule ba; cur_domain t = ksCurDomain ba; domain_time t = ksDomainTime ba; pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); ctes_of ba = (ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>y. cap') aa) \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksArchState ba = ksArchState b \<and> (pspace_aligned' b \<longrightarrow> pspace_aligned' ba) \<and> (pspace_distinct' b \<longrightarrow> pspace_distinct' ba); ctes_of b (cte_map slot) = Some aa; cte_wp_at (\<lambda>_. True) c a\<rbrakk> \<Longrightarrow> no_loops (ctes_of b) proof (prove)
goal:
No subgoals!