theory CSpace_R

lemma updateCap_same_master:
  "\<lbrakk> cap_relation cap cap' \<rbrakk> \<Longrightarrow>
   corres dc (valid_objs and pspace_aligned and pspace_distinct and
              cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and>
                             \<not>is_reply_cap c \<and> \<not>is_master_reply_cap c \<and>
                             \<not>is_ep_cap c \<and> \<not>is_ntfn_cap c) slot)
             (pspace_aligned' and pspace_distinct' and cte_at' (cte_map slot))
     (set_cap cap slot)
     (updateCap (cte_map slot) cap')" (is "_ \<Longrightarrow> corres _ ?P ?P' _ _") apply (unfold updateCap_def) apply (rule corres_guard_imp) apply (rule_tac Q="?P" and R'="\<lambda>cte. ?P' and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)"
      in corres_symb_exec_r_conj) apply (rule corres_stronger_no_failI) apply (rule no_fail_pre, wp) apply (clarsimp simp: cte_wp_at_ctes_of) apply clarsimp apply (clarsimp simp add: state_relation_def) apply (drule (1) pspace_relationsD) apply (frule (4) set_cap_not_quite_corres_prequel) apply (erule cte_wp_at_weakenE, rule TrueI) apply assumption apply assumption apply simp apply (rule refl) apply clarsimp apply (rule bexI) prefer 2 apply assumption apply (clarsimp simp: pspace_relations_def) apply (subst conj_assoc[symmetric]) apply (rule conjI) apply (frule setCTE_pspace_only) apply (clarsimp simp: set_cap_def in_monad split_def get_object_def set_object_def
                         split: if_split_asm Structures_A.kernel_object.splits) apply (rule conjI) apply (clarsimp simp: ghost_relation_typ_at set_cap_a_type_inv data_at_def) apply (intro allI conjI) apply (frule use_valid[OF _ setCTE_gsUserPages]) prefer 2 apply simp+ apply (frule use_valid[OF _ setCTE_gsCNodes]) prefer 2 apply simp+ apply (subst conj_assoc[symmetric]) apply (rule conjI) prefer 2 apply (rule conjI) prefer 2 apply (frule setCTE_pspace_only) apply clarsimp apply (clarsimp simp: set_cap_def in_monad split_def get_object_def set_object_def
                         split: if_split_asm Structures_A.kernel_object.splits) apply (frule set_cap_caps_of_state_monad) apply (drule is_original_cap_set_cap) apply clarsimp apply (erule use_valid [OF _ setCTE_ctes_of_wp]) apply (clarsimp simp: revokable_relation_def simp del: fun_upd_apply) apply (clarsimp split: if_split_asm) apply (drule cte_map_inj_eq) prefer 2 apply (erule cte_wp_at_weakenE, rule TrueI) apply (simp add: null_filter_def split: if_split_asm) apply (erule cte_wp_at_weakenE, rule TrueI) apply (erule caps_of_state_cte_at) apply fastforce apply fastforce apply fastforce apply clarsimp apply (simp add: null_filter_def split: if_split_asm) apply (erule_tac x=aa in allE, erule_tac x=bb in allE) apply (clarsimp simp: cte_wp_at_caps_of_state) apply (erule disjE) apply (clarsimp simp: cap_master_cap_simps dest!: cap_master_cap_eqDs) apply (case_tac rv) apply clarsimp apply (subgoal_tac "(aa,bb) \<noteq> slot") prefer 2 apply clarsimp apply (simp add: null_filter_def cte_wp_at_caps_of_state split: if_split_asm) apply (clarsimp simp: cdt_relation_def) apply (frule set_cap_caps_of_state_monad) apply (frule mdb_set_cap, frule exst_set_cap) apply clarsimp apply (erule use_valid [OF _ setCTE_ctes_of_wp]) apply (frule cte_wp_at_norm) apply (clarsimp simp del: fun_upd_apply) apply (frule (1) pspace_relation_ctes_ofI) apply fastforce apply fastforce apply (clarsimp simp del: fun_upd_apply) apply (subst same_master_descendants) apply assumption apply (clarsimp simp: master_cap_relation) apply (frule_tac d=c in master_cap_relation [symmetric], assumption) apply (frule is_reply_cap_relation[symmetric],
                 drule is_reply_master_relation[symmetric])+ apply simp apply (drule masterCap.intro) apply (drule masterCap.isReplyCap) apply simp apply (drule is_ep_cap_relation)+ apply (drule master_cap_ep) apply simp apply (drule is_ntfn_cap_relation)+ apply (drule master_cap_ntfn) apply simp apply (simp add: in_set_cap_cte_at) apply(simp add: cdt_list_relation_def split del: if_split) apply(intro allI impI) apply(erule_tac x=aa in allE)+ apply(erule_tac x=bb in allE)+ apply(clarsimp split: if_split_asm) apply(case_tac rv, clarsimp) apply (wp getCTE_wp')+ apply clarsimp apply (rule no_fail_pre, wp) apply clarsimp apply assumption apply clarsimp apply (clarsimp simp: cte_wp_at_ctes_of) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. cap_relation cap cap' \<Longrightarrow> corres dc (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) (set_cap cap slot) (updateCap (cte_map slot) cap') proof (prove)
goal (1 subgoal):
 1. cap_relation cap cap' \<Longrightarrow> corres dc (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) (set_cap cap slot) (do cte <- getCTE (cte_map slot);
setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') cte)
od) proof (prove)
goal (3 subgoals):
 1. cap_relation cap cap' \<Longrightarrow> corres dc ?Q ?Q' (set_cap cap slot) (do cte <- getCTE (cte_map slot);
setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') cte)
od)
 2. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> ?Q s
 3. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> ?Q' s proof (prove)
goal (6 subgoals):
 1. \<And>rv. cap_relation cap cap' \<Longrightarrow> corres dc (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some rv)) (set_cap cap slot) (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv))
 2. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 3. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 4. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 5. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (7 subgoals):
 1. \<And>rv. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. \<exists>s. (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s \<and> (s, s') \<in> state_relation \<and> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some rv)) s') (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv))
 2. \<And>rv. cap_relation cap cap' \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s \<and> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some rv)) s' \<longrightarrow> (\<forall>(r', t')\<in>fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) s'). \<exists>(r, t)\<in>fst (set_cap cap slot s). (t, t') \<in> state_relation \<and> dc r r')
 3. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 4. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 5. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (7 subgoals):
 1. \<And>rv s. \<lbrakk>cap_relation cap cap'; True; \<exists>sa. (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) sa \<and> (sa, s) \<in> state_relation \<and> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some rv)) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s
 2. \<And>rv. cap_relation cap cap' \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s \<and> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some rv)) s' \<longrightarrow> (\<forall>(r', t')\<in>fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) s'). \<exists>(r, t)\<in>fst (set_cap cap slot s). (t, t') \<in> state_relation \<and> dc r r')
 3. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 4. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 5. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (6 subgoals):
 1. \<And>rv. cap_relation cap cap' \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s \<and> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some rv)) s' \<longrightarrow> (\<forall>(r', t')\<in>fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) s'). \<exists>(r, t)\<in>fst (set_cap cap slot s). (t, t') \<in> state_relation \<and> dc r r')
 2. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 3. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 4. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 5. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (6 subgoals):
 1. \<And>rv a b ba. \<lbrakk>cap_relation cap cap'; (a, b) \<in> state_relation; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap cap slot a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation
 2. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 3. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 4. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 5. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (6 subgoals):
 1. \<And>rv a b ba. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap cap slot a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 2. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 3. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 4. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 5. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (6 subgoals):
 1. \<And>rv a b ba. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap cap slot a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 2. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 3. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 4. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 5. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (11 subgoals):
 1. \<And>rv a b ba. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (?p59 rv a b ba) a
 2. \<And>rv a b ba. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b)\<rbrakk> \<Longrightarrow> pspace_aligned' b
 3. \<And>rv a b ba. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b)\<rbrakk> \<Longrightarrow> pspace_distinct' b
 4. \<And>rv a b ba. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b)\<rbrakk> \<Longrightarrow> cap_relation (?c59 rv a b ba) (cteCap (cteCap_update (\<lambda>_. cap') rv))
 5. \<And>rv a b ba. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b)\<rbrakk> \<Longrightarrow> cte_map slot = cte_map (?p59 rv a b ba)
 6. \<And>rv a b ba. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b); \<exists>t. ((), t) \<in> fst (set_cap (?c59 rv a b ba) (?p59 rv a b ba) a) \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap cap slot a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 7. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 8. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 9. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 10. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>rv a b ba. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b)\<rbrakk> \<Longrightarrow> pspace_aligned' b
 2. \<And>rv a b ba. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b)\<rbrakk> \<Longrightarrow> pspace_distinct' b
 3. \<And>rv a b ba. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b)\<rbrakk> \<Longrightarrow> cap_relation (?c59 rv a b ba) (cteCap (cteCap_update (\<lambda>_. cap') rv))
 4. \<And>rv a b ba. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b)\<rbrakk> \<Longrightarrow> cte_map slot = cte_map slot
 5. \<And>rv a b ba. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b); \<exists>t. ((), t) \<in> fst (set_cap (?c59 rv a b ba) slot a) \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap cap slot a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 6. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 7. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 8. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 9. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 10. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (9 subgoals):
 1. \<And>rv a b ba. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b)\<rbrakk> \<Longrightarrow> pspace_distinct' b
 2. \<And>rv a b ba. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b)\<rbrakk> \<Longrightarrow> cap_relation (?c59 rv a b ba) (cteCap (cteCap_update (\<lambda>_. cap') rv))
 3. \<And>rv a b ba. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b)\<rbrakk> \<Longrightarrow> cte_map slot = cte_map slot
 4. \<And>rv a b ba. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b); \<exists>t. ((), t) \<in> fst (set_cap (?c59 rv a b ba) slot a) \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap cap slot a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 5. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 6. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 7. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 8. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 9. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (8 subgoals):
 1. \<And>rv a b ba. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b)\<rbrakk> \<Longrightarrow> cap_relation (?c59 rv a b ba) (cteCap (cteCap_update (\<lambda>_. cap') rv))
 2. \<And>rv a b ba. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b)\<rbrakk> \<Longrightarrow> cte_map slot = cte_map slot
 3. \<And>rv a b ba. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b); \<exists>t. ((), t) \<in> fst (set_cap (?c59 rv a b ba) slot a) \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap cap slot a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 4. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 5. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 6. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 8. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (7 subgoals):
 1. \<And>rv a b ba. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b)\<rbrakk> \<Longrightarrow> cte_map slot = cte_map slot
 2. \<And>rv a b ba. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b); \<exists>t. ((), t) \<in> fst (set_cap cap slot a) \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap cap slot a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 3. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 4. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 5. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (6 subgoals):
 1. \<And>rv a b ba. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b); \<exists>t. ((), t) \<in> fst (set_cap cap slot a) \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap cap slot a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 2. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 3. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 4. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 5. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (6 subgoals):
 1. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relations (ekheap t) (kheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap cap slot a). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 2. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 3. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 4. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 5. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (7 subgoals):
 1. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relations (ekheap t) (kheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> case ?x77 rv a b ba t of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 2. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relations (ekheap t) (kheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> ?x77 rv a b ba t \<in> fst (set_cap cap slot a)
 3. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 4. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 5. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (7 subgoals):
 1. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relations (ekheap t) (kheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> ?x77 rv a b ba t \<in> fst (set_cap cap slot a)
 2. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relations (ekheap t) (kheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> case ?x77 rv a b ba t of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 3. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 4. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 5. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (6 subgoals):
 1. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relations (ekheap t) (kheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> case ((), t) of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 2. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 3. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 4. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 5. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (6 subgoals):
 1. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 2. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 3. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 4. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 5. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (6 subgoals):
 1. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> (sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba)) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 2. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 3. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 4. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 5. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (7 subgoals):
 1. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba)
 2. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 3. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 4. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 5. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (7 subgoals):
 1. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); \<exists>ps'. ba = b\<lparr>ksPSpace := ps'\<rparr>\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba)
 2. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 3. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 4. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 5. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (6 subgoals):
 1. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 2. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 3. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 4. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 5. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (7 subgoals):
 1. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba)
 2. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 3. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 4. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 5. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (7 subgoals):
 1. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); \<forall>aa sz. (typ_at (AArch (AUserData sz)) aa a \<or> typ_at (AArch (ADeviceData sz)) aa a) = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> (\<forall>a sz. (gsUserPages b a = Some sz) = (gsUserPages ba a = Some sz)) \<and> (\<forall>a n. (gsCNodes b a = Some n) = (gsCNodes ba a = Some n))
 2. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 3. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 4. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 5. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (8 subgoals):
 1. \<And>rv a b ba t aa sz. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); \<forall>aa sz. (typ_at (AArch (AUserData sz)) aa a \<or> typ_at (AArch (ADeviceData sz)) aa a) = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> (gsUserPages b aa = Some sz) = (gsUserPages ba aa = Some sz)
 2. \<And>rv a b ba t aa n. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); \<forall>aa sz. (typ_at (AArch (AUserData sz)) aa a \<or> typ_at (AArch (ADeviceData sz)) aa a) = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> (gsCNodes b aa = Some n) = (gsCNodes ba aa = Some n)
 3. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 4. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 5. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 6. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 8. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (9 subgoals):
 1. \<And>rv a b ba t aa sz. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); \<forall>aa sz. (typ_at (AArch (AUserData sz)) aa a \<or> typ_at (AArch (ADeviceData sz)) aa a) = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> ?P200 rv a b ba t aa sz (gsUserPages b)
 2. \<And>rv a b ba t aa sz. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); \<forall>aa sz. (typ_at (AArch (AUserData sz)) aa a \<or> typ_at (AArch (ADeviceData sz)) aa a) = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); ?P200 rv a b ba t aa sz (gsUserPages ba)\<rbrakk> \<Longrightarrow> (gsUserPages b aa = Some sz) = (gsUserPages ba aa = Some sz)
 3. \<And>rv a b ba t aa n. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); \<forall>aa sz. (typ_at (AArch (AUserData sz)) aa a \<or> typ_at (AArch (ADeviceData sz)) aa a) = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> (gsCNodes b aa = Some n) = (gsCNodes ba aa = Some n)
 4. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 5. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 6. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 7. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 8. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 9. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (9 subgoals):
 1. \<And>rv a b ba t aa sz. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); \<forall>aa sz. (typ_at (AArch (AUserData sz)) aa a \<or> typ_at (AArch (ADeviceData sz)) aa a) = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); ?P200 rv a b ba t aa sz (gsUserPages ba)\<rbrakk> \<Longrightarrow> (gsUserPages b aa = Some sz) = (gsUserPages ba aa = Some sz)
 2. \<And>rv a b ba t aa sz. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); \<forall>aa sz. (typ_at (AArch (AUserData sz)) aa a \<or> typ_at (AArch (ADeviceData sz)) aa a) = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> ?P200 rv a b ba t aa sz (gsUserPages b)
 3. \<And>rv a b ba t aa n. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); \<forall>aa sz. (typ_at (AArch (AUserData sz)) aa a \<or> typ_at (AArch (ADeviceData sz)) aa a) = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> (gsCNodes b aa = Some n) = (gsCNodes ba aa = Some n)
 4. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 5. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 6. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 7. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 8. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 9. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (7 subgoals):
 1. \<And>rv a b ba t aa n. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); \<forall>aa sz. (typ_at (AArch (AUserData sz)) aa a \<or> typ_at (AArch (ADeviceData sz)) aa a) = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> (gsCNodes b aa = Some n) = (gsCNodes ba aa = Some n)
 2. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 3. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 4. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 5. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (8 subgoals):
 1. \<And>rv a b ba t aa n. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); \<forall>aa sz. (typ_at (AArch (AUserData sz)) aa a \<or> typ_at (AArch (ADeviceData sz)) aa a) = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> ?P204 rv a b ba t aa n (gsCNodes b)
 2. \<And>rv a b ba t aa n. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); \<forall>aa sz. (typ_at (AArch (AUserData sz)) aa a \<or> typ_at (AArch (ADeviceData sz)) aa a) = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); ?P204 rv a b ba t aa n (gsCNodes ba)\<rbrakk> \<Longrightarrow> (gsCNodes b aa = Some n) = (gsCNodes ba aa = Some n)
 3. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 4. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 5. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 6. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 8. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (8 subgoals):
 1. \<And>rv a b ba t aa n. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); \<forall>aa sz. (typ_at (AArch (AUserData sz)) aa a \<or> typ_at (AArch (ADeviceData sz)) aa a) = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); ?P204 rv a b ba t aa n (gsCNodes ba)\<rbrakk> \<Longrightarrow> (gsCNodes b aa = Some n) = (gsCNodes ba aa = Some n)
 2. \<And>rv a b ba t aa n. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); \<forall>aa sz. (typ_at (AArch (AUserData sz)) aa a \<or> typ_at (AArch (ADeviceData sz)) aa a) = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> ?P204 rv a b ba t aa n (gsCNodes b)
 3. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 4. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 5. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 6. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 8. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (6 subgoals):
 1. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 2. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 3. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 4. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 5. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (6 subgoals):
 1. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> (cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba)) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 2. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 3. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 4. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 5. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (7 subgoals):
 1. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba)
 2. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 3. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 4. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 5. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (7 subgoals):
 1. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 2. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba)
 3. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 4. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 5. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (8 subgoals):
 1. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba)
 2. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 3. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba)
 4. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 5. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 6. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 8. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (8 subgoals):
 1. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 2. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba)
 3. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba)
 4. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 5. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 6. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 8. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (8 subgoals):
 1. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); \<exists>ps'. ba = b\<lparr>ksPSpace := ps'\<rparr>\<rbrakk> \<Longrightarrow> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 2. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba)
 3. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba)
 4. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 5. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 6. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 8. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (8 subgoals):
 1. \<And>rv a b t ps'. \<lbrakk>cap_relation cap cap'; ((), b\<lparr>ksPSpace := ps'\<rparr>) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) ps'; ekheap_relation (ekheap t) ps'\<rbrakk> \<Longrightarrow> (arch_state t, ksArchState b) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState b) \<and> cur_thread t = ksCurThread b \<and> idle_thread t = ksIdleThread b \<and> machine_state t = ksMachineState b \<and> work_units_completed t = ksWorkUnitsCompleted b \<and> domain_index t = ksDomScheduleIdx b \<and> domain_list t = ksDomSchedule b \<and> cur_domain t = ksCurDomain b \<and> domain_time t = ksDomainTime b
 2. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba)
 3. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba)
 4. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 5. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 6. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 8. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (7 subgoals):
 1. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba)
 2. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba)
 3. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 4. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 5. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (7 subgoals):
 1. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap)\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba)
 2. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba)
 3. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 4. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 5. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (7 subgoals):
 1. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba)
 2. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba)
 3. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 4. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 5. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (7 subgoals):
 1. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap a) (null_filter ((caps_of_state a)(slot \<mapsto> cap))) (ctes_of ba)
 2. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba)
 3. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 4. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 5. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (7 subgoals):
 1. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap a) (null_filter ((caps_of_state a)(slot \<mapsto> cap))) ((ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>_. cap') rv))
 2. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba)
 3. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 4. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 5. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (7 subgoals):
 1. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; ((ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>_. cap') rv)) (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 2. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba)
 3. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 4. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 5. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (8 subgoals):
 1. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map slot; cteCap_update (\<lambda>_. cap') rv = CTE capa node\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 2. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cte_map (aa, bb) \<noteq> cte_map slot; ctes_of b (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 3. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba)
 4. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 5. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 6. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 8. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (13 subgoals):
 1. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cteCap_update (\<lambda>_. cap') rv = CTE capa node\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (aa, bb) (?s352 rv a b ba t aa bb y capa node)
 2. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cteCap_update (\<lambda>_. cap') rv = CTE capa node\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot (?s352 rv a b ba t aa bb y capa node)
 3. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cteCap_update (\<lambda>_. cap') rv = CTE capa node\<rbrakk> \<Longrightarrow> valid_objs (?s352 rv a b ba t aa bb y capa node)
 4. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cteCap_update (\<lambda>_. cap') rv = CTE capa node\<rbrakk> \<Longrightarrow> pspace_aligned (?s352 rv a b ba t aa bb y capa node)
 5. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cteCap_update (\<lambda>_. cap') rv = CTE capa node\<rbrakk> \<Longrightarrow> pspace_distinct (?s352 rv a b ba t aa bb y capa node)
 6. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cteCap_update (\<lambda>_. cap') rv = CTE capa node; (aa, bb) = slot\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 7. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cte_map (aa, bb) \<noteq> cte_map slot; ctes_of b (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 8. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba)
 9. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 10. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cteCap_update (\<lambda>_. cap') rv = CTE capa node\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot (?s352 rv a b ba t aa bb y capa node)
 2. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cteCap_update (\<lambda>_. cap') rv = CTE capa node\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (aa, bb) (?s352 rv a b ba t aa bb y capa node)
 3. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cteCap_update (\<lambda>_. cap') rv = CTE capa node\<rbrakk> \<Longrightarrow> valid_objs (?s352 rv a b ba t aa bb y capa node)
 4. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cteCap_update (\<lambda>_. cap') rv = CTE capa node\<rbrakk> \<Longrightarrow> pspace_aligned (?s352 rv a b ba t aa bb y capa node)
 5. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cteCap_update (\<lambda>_. cap') rv = CTE capa node\<rbrakk> \<Longrightarrow> pspace_distinct (?s352 rv a b ba t aa bb y capa node)
 6. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cteCap_update (\<lambda>_. cap') rv = CTE capa node; (aa, bb) = slot\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 7. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cte_map (aa, bb) \<noteq> cte_map slot; ctes_of b (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 8. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba)
 9. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 10. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cteCap_update (\<lambda>_. cap') rv = CTE capa node\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (aa, bb) a
 2. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cteCap_update (\<lambda>_. cap') rv = CTE capa node\<rbrakk> \<Longrightarrow> valid_objs a
 3. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cteCap_update (\<lambda>_. cap') rv = CTE capa node\<rbrakk> \<Longrightarrow> pspace_aligned a
 4. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cteCap_update (\<lambda>_. cap') rv = CTE capa node\<rbrakk> \<Longrightarrow> pspace_distinct a
 5. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cteCap_update (\<lambda>_. cap') rv = CTE capa node; (aa, bb) = slot\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 6. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cte_map (aa, bb) \<noteq> cte_map slot; ctes_of b (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 7. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba)
 8. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 9. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
A total of 12 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cteCap_update (\<lambda>_. cap') rv = CTE capa node; cap_relation y cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap y \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. caps_of_state a (aa, ba) = Some cap.NullCap \<or> caps_of_state a (aa, ba) = None \<or> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> y); is_original_cap t = is_original_cap a; y \<noteq> cap.NullCap; (aa, bb) = slot; cap = y\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot a
 2. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cteCap_update (\<lambda>_. cap') rv = CTE capa node; cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. caps_of_state a (aa, ba) = Some cap.NullCap \<or> caps_of_state a (aa, ba) = None \<or> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; y \<noteq> cap.NullCap; (aa, bb) \<noteq> slot; caps_of_state a (aa, bb) = Some y\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (aa, bb) a
 3. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cteCap_update (\<lambda>_. cap') rv = CTE capa node\<rbrakk> \<Longrightarrow> valid_objs a
 4. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cteCap_update (\<lambda>_. cap') rv = CTE capa node\<rbrakk> \<Longrightarrow> pspace_aligned a
 5. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cteCap_update (\<lambda>_. cap') rv = CTE capa node\<rbrakk> \<Longrightarrow> pspace_distinct a
 6. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cteCap_update (\<lambda>_. cap') rv = CTE capa node; (aa, bb) = slot\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 7. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cte_map (aa, bb) \<noteq> cte_map slot; ctes_of b (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 8. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba)
 9. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 10. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cteCap_update (\<lambda>_. cap') rv = CTE capa node; cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. caps_of_state a (aa, ba) = Some cap.NullCap \<or> caps_of_state a (aa, ba) = None \<or> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; y \<noteq> cap.NullCap; (aa, bb) \<noteq> slot; caps_of_state a (aa, bb) = Some y\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (aa, bb) a
 2. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cteCap_update (\<lambda>_. cap') rv = CTE capa node\<rbrakk> \<Longrightarrow> valid_objs a
 3. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cteCap_update (\<lambda>_. cap') rv = CTE capa node\<rbrakk> \<Longrightarrow> pspace_aligned a
 4. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cteCap_update (\<lambda>_. cap') rv = CTE capa node\<rbrakk> \<Longrightarrow> pspace_distinct a
 5. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cteCap_update (\<lambda>_. cap') rv = CTE capa node; (aa, bb) = slot\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 6. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cte_map (aa, bb) \<noteq> cte_map slot; ctes_of b (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 7. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba)
 8. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 9. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 10. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cteCap_update (\<lambda>_. cap') rv = CTE capa node\<rbrakk> \<Longrightarrow> valid_objs a
 2. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cteCap_update (\<lambda>_. cap') rv = CTE capa node\<rbrakk> \<Longrightarrow> pspace_aligned a
 3. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cteCap_update (\<lambda>_. cap') rv = CTE capa node\<rbrakk> \<Longrightarrow> pspace_distinct a
 4. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cteCap_update (\<lambda>_. cap') rv = CTE capa node; (aa, bb) = slot\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 5. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cte_map (aa, bb) \<noteq> cte_map slot; ctes_of b (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 6. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba)
 7. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 8. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 9. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 10. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cteCap_update (\<lambda>_. cap') rv = CTE capa node\<rbrakk> \<Longrightarrow> pspace_aligned a
 2. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cteCap_update (\<lambda>_. cap') rv = CTE capa node\<rbrakk> \<Longrightarrow> pspace_distinct a
 3. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cteCap_update (\<lambda>_. cap') rv = CTE capa node; (aa, bb) = slot\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 4. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cte_map (aa, bb) \<noteq> cte_map slot; ctes_of b (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 5. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba)
 6. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 7. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 8. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 9. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 10. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (9 subgoals):
 1. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cteCap_update (\<lambda>_. cap') rv = CTE capa node\<rbrakk> \<Longrightarrow> pspace_distinct a
 2. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cteCap_update (\<lambda>_. cap') rv = CTE capa node; (aa, bb) = slot\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 3. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cte_map (aa, bb) \<noteq> cte_map slot; ctes_of b (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 4. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba)
 5. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 6. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 7. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 8. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 9. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (8 subgoals):
 1. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cteCap_update (\<lambda>_. cap') rv = CTE capa node; (aa, bb) = slot\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 2. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cte_map (aa, bb) \<noteq> cte_map slot; ctes_of b (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 3. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba)
 4. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 5. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 6. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 8. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (8 subgoals):
 1. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (aa, bb) a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map (aa, bb)) b; ctes_of b (cte_map (aa, bb)) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)((aa, bb) \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)((aa, bb) \<mapsto> cap)) (aa, bb) = Some y; cteCap_update (\<lambda>_. cap') rv = CTE capa node; slot = (aa, bb)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 2. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cte_map (aa, bb) \<noteq> cte_map slot; ctes_of b (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 3. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba)
 4. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 5. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 6. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 8. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (8 subgoals):
 1. \<And>rv a b ba t aa bb capa node. \<lbrakk>\<forall>aa ba. caps_of_state a (aa, ba) = Some cap.NullCap \<or> caps_of_state a (aa, ba) = None \<or> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)((aa, bb) \<mapsto> cap); is_original_cap t = is_original_cap a; cap \<noteq> cap.NullCap; cteCap_update (\<lambda>_. cap') rv = CTE capa node; slot = (aa, bb); cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (aa, bb) a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map (aa, bb)) b; ctes_of b (cte_map (aa, bb)) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 2. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cte_map (aa, bb) \<noteq> cte_map slot; ctes_of b (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 3. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba)
 4. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 5. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 6. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 8. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (8 subgoals):
 1. \<And>rv a b ba t aa bb capa node. \<lbrakk>(arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)((aa, bb) \<mapsto> cap); is_original_cap t = is_original_cap a; cap \<noteq> cap.NullCap; cteCap_update (\<lambda>_. cap') rv = CTE capa node; slot = (aa, bb); cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) (aa, bb) a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map (aa, bb)) b; ctes_of b (cte_map (aa, bb)) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); caps_of_state a (aa, bb) = Some cap.NullCap \<or> caps_of_state a (aa, bb) = None \<or> (\<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 2. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cte_map (aa, bb) \<noteq> cte_map slot; ctes_of b (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 3. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba)
 4. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 5. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 6. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 8. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (8 subgoals):
 1. \<And>rv a b ba t aa bb capa node capaa. \<lbrakk>(arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)((aa, bb) \<mapsto> cap); is_original_cap t = is_original_cap a; cap \<noteq> cap.NullCap; cteCap_update (\<lambda>_. cap') rv = CTE capa node; slot = (aa, bb); cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map (aa, bb)) b; ctes_of b (cte_map (aa, bb)) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); capaa = cap.NullCap \<or> (\<forall>cap node. rv = CTE cap node \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node); caps_of_state a (aa, bb) = Some capaa; cap_master_cap capaa = cap_master_cap cap; \<not> is_reply_cap capaa; \<not> is_master_reply_cap capaa; \<not> is_ep_cap capaa; \<not> is_ntfn_cap capaa\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 2. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cte_map (aa, bb) \<noteq> cte_map slot; ctes_of b (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 3. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba)
 4. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 5. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 6. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 8. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (9 subgoals):
 1. \<And>rv a b ba t aa bb capa node capaa. \<lbrakk>(arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)((aa, bb) \<mapsto> cap); is_original_cap t = is_original_cap a; cap \<noteq> cap.NullCap; cteCap_update (\<lambda>_. cap') rv = CTE capa node; slot = (aa, bb); cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map (aa, bb)) b; ctes_of b (cte_map (aa, bb)) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); caps_of_state a (aa, bb) = Some capaa; cap_master_cap capaa = cap_master_cap cap; \<not> is_reply_cap capaa; \<not> is_master_reply_cap capaa; \<not> is_ep_cap capaa; \<not> is_ntfn_cap capaa; capaa = cap.NullCap\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 2. \<And>rv a b ba t aa bb capa node capaa. \<lbrakk>(arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)((aa, bb) \<mapsto> cap); is_original_cap t = is_original_cap a; cap \<noteq> cap.NullCap; cteCap_update (\<lambda>_. cap') rv = CTE capa node; slot = (aa, bb); cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map (aa, bb)) b; ctes_of b (cte_map (aa, bb)) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); caps_of_state a (aa, bb) = Some capaa; cap_master_cap capaa = cap_master_cap cap; \<not> is_reply_cap capaa; \<not> is_master_reply_cap capaa; \<not> is_ep_cap capaa; \<not> is_ntfn_cap capaa; \<forall>cap node. rv = CTE cap node \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 3. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cte_map (aa, bb) \<noteq> cte_map slot; ctes_of b (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 4. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba)
 5. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 6. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 7. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 8. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 9. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (8 subgoals):
 1. \<And>rv a b ba t aa bb capa node capaa. \<lbrakk>(arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)((aa, bb) \<mapsto> cap); is_original_cap t = is_original_cap a; cap \<noteq> cap.NullCap; cteCap_update (\<lambda>_. cap') rv = CTE capa node; slot = (aa, bb); cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map (aa, bb)) b; ctes_of b (cte_map (aa, bb)) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); caps_of_state a (aa, bb) = Some capaa; cap_master_cap capaa = cap_master_cap cap; \<not> is_reply_cap capaa; \<not> is_master_reply_cap capaa; \<not> is_ep_cap capaa; \<not> is_ntfn_cap capaa; \<forall>cap node. rv = CTE cap node \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 2. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cte_map (aa, bb) \<noteq> cte_map slot; ctes_of b (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 3. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba)
 4. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 5. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 6. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 8. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (8 subgoals):
 1. \<And>rv a b ba t aa bb capa node capaa x1 x2. \<lbrakk>(arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)((aa, bb) \<mapsto> cap); is_original_cap t = is_original_cap a; cap \<noteq> cap.NullCap; cteCap_update (\<lambda>_. cap') rv = CTE capa node; slot = (aa, bb); cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map (aa, bb)) b; ctes_of b (cte_map (aa, bb)) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); caps_of_state a (aa, bb) = Some capaa; cap_master_cap capaa = cap_master_cap cap; \<not> is_reply_cap capaa; \<not> is_master_reply_cap capaa; \<not> is_ep_cap capaa; \<not> is_ntfn_cap capaa; \<forall>cap node. rv = CTE cap node \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node; rv = CTE x1 x2\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 2. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cte_map (aa, bb) \<noteq> cte_map slot; ctes_of b (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 3. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba)
 4. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 5. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 6. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 8. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (7 subgoals):
 1. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cte_map (aa, bb) \<noteq> cte_map slot; ctes_of b (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 2. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba)
 3. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 4. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 5. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (8 subgoals):
 1. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cte_map (aa, bb) \<noteq> cte_map slot; ctes_of b (cte_map (aa, bb)) = Some (CTE capa node); (aa, bb) \<noteq> slot\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 2. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cte_map (aa, bb) \<noteq> cte_map slot; ctes_of b (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> (aa, bb) \<noteq> slot
 3. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba)
 4. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 5. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 6. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 8. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (8 subgoals):
 1. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cte_map (aa, bb) \<noteq> cte_map slot; ctes_of b (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> (aa, bb) \<noteq> slot
 2. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cte_map (aa, bb) \<noteq> cte_map slot; ctes_of b (cte_map (aa, bb)) = Some (CTE capa node); (aa, bb) \<noteq> slot\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 3. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba)
 4. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 5. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 6. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 8. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (7 subgoals):
 1. \<And>rv a b ba t aa bb y capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(slot \<mapsto> cap)) (aa, bb) = Some y; cte_map (aa, bb) \<noteq> cte_map slot; ctes_of b (cte_map (aa, bb)) = Some (CTE capa node); (aa, bb) \<noteq> slot\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 2. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba)
 3. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 4. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 5. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (6 subgoals):
 1. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba)
 2. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 3. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 4. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 5. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (6 subgoals):
 1. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>_. True) (a, b) t \<longrightarrow> cte_map ` descendants_of (a, b) (cdt t) = descendants_of' (cte_map (a, b)) (ctes_of ba)) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba)
 2. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 3. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 4. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 5. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (6 subgoals):
 1. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap)\<rbrakk> \<Longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>_. True) (a, b) t \<longrightarrow> cte_map ` descendants_of (a, b) (cdt t) = descendants_of' (cte_map (a, b)) (ctes_of ba)) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba)
 2. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 3. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 4. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 5. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (6 subgoals):
 1. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a\<rbrakk> \<Longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>_. True) (a, b) t \<longrightarrow> cte_map ` descendants_of (a, b) (cdt t) = descendants_of' (cte_map (a, b)) (ctes_of ba)) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba)
 2. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 3. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 4. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 5. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (6 subgoals):
 1. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; ((), ba) \<in> fst (setCTE (cte_map slot) (cteCap_update (\<lambda>_. cap') rv) b); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a\<rbrakk> \<Longrightarrow> (\<forall>aa b. cte_wp_at (\<lambda>_. True) (aa, b) t \<longrightarrow> cte_map ` descendants_of (aa, b) (cdt a) = descendants_of' (cte_map (aa, b)) (ctes_of ba)) \<and> cdt_list_relation (cdt_list a) (cdt a) (ctes_of ba)
 2. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 3. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 4. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 5. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (6 subgoals):
 1. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a\<rbrakk> \<Longrightarrow> (\<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) t \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) ((ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>_. cap') rv))) \<and> cdt_list_relation (cdt_list a) (cdt a) ((ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>_. cap') rv))
 2. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 3. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 4. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 5. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (6 subgoals):
 1. \<And>rv a b ba t. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; \<exists>c. cte_wp_at ((=) c) slot a \<and> cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c\<rbrakk> \<Longrightarrow> (\<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) t \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) ((ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>_. cap') rv))) \<and> cdt_list_relation (cdt_list a) (cdt a) ((ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>_. cap') rv))
 2. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 3. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 4. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 5. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (6 subgoals):
 1. \<And>rv a b ba t c. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c\<rbrakk> \<Longrightarrow> (\<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) t \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) ((ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>_. cap') rv))) \<and> cdt_list_relation (cdt_list a) (cdt a) ((ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>_. cap') rv))
 2. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 3. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 4. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 5. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (8 subgoals):
 1. \<And>rv a b ba t c. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c\<rbrakk> \<Longrightarrow> pspace_aligned' b
 2. \<And>rv a b ba t c. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c\<rbrakk> \<Longrightarrow> pspace_distinct' b
 3. \<And>rv a b ba t c. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; \<exists>cte. ctes_of b (cte_map slot) = Some cte \<and> cap_relation c (cteCap cte)\<rbrakk> \<Longrightarrow> (\<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) t \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) ((ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>_. cap') rv))) \<and> cdt_list_relation (cdt_list a) (cdt a) ((ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>_. cap') rv))
 4. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 5. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 6. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 8. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (7 subgoals):
 1. \<And>rv a b ba t c. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c\<rbrakk> \<Longrightarrow> pspace_distinct' b
 2. \<And>rv a b ba t c. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; \<exists>cte. ctes_of b (cte_map slot) = Some cte \<and> cap_relation c (cteCap cte)\<rbrakk> \<Longrightarrow> (\<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) t \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) ((ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>_. cap') rv))) \<and> cdt_list_relation (cdt_list a) (cdt a) ((ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>_. cap') rv))
 3. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 4. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 5. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (6 subgoals):
 1. \<And>rv a b ba t c. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; \<exists>cte. ctes_of b (cte_map slot) = Some cte \<and> cap_relation c (cteCap cte)\<rbrakk> \<Longrightarrow> (\<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) t \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) ((ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>_. cap') rv))) \<and> cdt_list_relation (cdt_list a) (cdt a) ((ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>_. cap') rv))
 2. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 3. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 4. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 5. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (6 subgoals):
 1. \<And>rv a b ba t c. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> (\<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) t \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) ((ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>_. cap') rv))) \<and> cdt_list_relation (cdt_list a) (cdt a) ((ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>_. cap') rv))
 2. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 3. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 4. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 5. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (11 subgoals):
 1. \<And>rv a b ba t c baa aa. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> ctes_of b (cte_map slot) = Some rv
 2. \<And>rv a b ba t c baa aa. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> capMasterCap (cteCap rv) = capMasterCap cap'
 3. \<And>rv a b ba t c baa aa. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> \<not> isReplyCap cap'
 4. \<And>rv a b ba t c baa aa. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> \<not> isEndpointCap cap'
 5. \<And>rv a b ba t c baa aa. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> \<not> isNotificationCap cap'
 6. \<And>rv a b ba t c. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> (\<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) t \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b)) \<and> cdt_list_relation (cdt_list a) (cdt a) ((ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>_. cap') rv))
 7. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 8. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 9. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 10. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>rv a b ba t c baa aa. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> capMasterCap (cteCap rv) = capMasterCap cap'
 2. \<And>rv a b ba t c baa aa. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> \<not> isReplyCap cap'
 3. \<And>rv a b ba t c baa aa. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> \<not> isEndpointCap cap'
 4. \<And>rv a b ba t c baa aa. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> \<not> isNotificationCap cap'
 5. \<And>rv a b ba t c. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> (\<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) t \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b)) \<and> cdt_list_relation (cdt_list a) (cdt a) ((ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>_. cap') rv))
 6. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 7. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 8. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 9. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 10. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (9 subgoals):
 1. \<And>rv a b ba t c baa aa. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> \<not> isReplyCap cap'
 2. \<And>rv a b ba t c baa aa. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> \<not> isEndpointCap cap'
 3. \<And>rv a b ba t c baa aa. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> \<not> isNotificationCap cap'
 4. \<And>rv a b ba t c. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> (\<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) t \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b)) \<and> cdt_list_relation (cdt_list a) (cdt a) ((ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>_. cap') rv))
 5. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 6. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 7. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 8. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 9. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (9 subgoals):
 1. \<And>rv a b ba t c baa aa. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv); (cap_master_cap cap = cap_master_cap c) = (capMasterCap cap' = capMasterCap (cteCap rv))\<rbrakk> \<Longrightarrow> \<not> isReplyCap cap'
 2. \<And>rv a b ba t c baa aa. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> \<not> isEndpointCap cap'
 3. \<And>rv a b ba t c baa aa. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> \<not> isNotificationCap cap'
 4. \<And>rv a b ba t c. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> (\<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) t \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b)) \<and> cdt_list_relation (cdt_list a) (cdt a) ((ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>_. cap') rv))
 5. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 6. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 7. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 8. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 9. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (9 subgoals):
 1. \<And>rv a b ba t c baa aa. \<lbrakk>valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; (cap_master_cap cap = cap_master_cap c) = (capMasterCap cap' = capMasterCap (cteCap rv)); (isReplyCap cap' \<and> \<not> capReplyMaster cap') = is_reply_cap cap; (isReplyCap cap' \<and> capReplyMaster cap') = is_master_reply_cap cap; (isReplyCap (cteCap rv) \<and> \<not> capReplyMaster (cteCap rv)) = is_reply_cap c; (isReplyCap (cteCap rv) \<and> capReplyMaster (cteCap rv)) = is_master_reply_cap c\<rbrakk> \<Longrightarrow> \<not> isReplyCap cap'
 2. \<And>rv a b ba t c baa aa. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> \<not> isEndpointCap cap'
 3. \<And>rv a b ba t c baa aa. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> \<not> isNotificationCap cap'
 4. \<And>rv a b ba t c. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> (\<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) t \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b)) \<and> cdt_list_relation (cdt_list a) (cdt a) ((ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>_. cap') rv))
 5. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 6. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 7. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 8. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 9. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (9 subgoals):
 1. \<And>rv a b ba t c. \<lbrakk>valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; capMasterCap cap' = capMasterCap (cteCap rv); (isReplyCap cap' \<and> \<not> capReplyMaster cap') = is_reply_cap cap; (isReplyCap cap' \<and> capReplyMaster cap') = is_master_reply_cap cap; \<not> isReplyCap (cteCap rv)\<rbrakk> \<Longrightarrow> \<not> isReplyCap cap'
 2. \<And>rv a b ba t c baa aa. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> \<not> isEndpointCap cap'
 3. \<And>rv a b ba t c baa aa. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> \<not> isNotificationCap cap'
 4. \<And>rv a b ba t c. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> (\<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) t \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b)) \<and> cdt_list_relation (cdt_list a) (cdt a) ((ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>_. cap') rv))
 5. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 6. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 7. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 8. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 9. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (9 subgoals):
 1. \<And>rv a b ba t c. \<lbrakk>valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; (isReplyCap cap' \<and> \<not> capReplyMaster cap') = is_reply_cap cap; (isReplyCap cap' \<and> capReplyMaster cap') = is_master_reply_cap cap; \<not> isReplyCap (cteCap rv); masterCap cap' (cteCap rv)\<rbrakk> \<Longrightarrow> \<not> isReplyCap cap'
 2. \<And>rv a b ba t c baa aa. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> \<not> isEndpointCap cap'
 3. \<And>rv a b ba t c baa aa. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> \<not> isNotificationCap cap'
 4. \<And>rv a b ba t c. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> (\<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) t \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b)) \<and> cdt_list_relation (cdt_list a) (cdt a) ((ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>_. cap') rv))
 5. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 6. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 7. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 8. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 9. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (9 subgoals):
 1. \<And>rv a b ba t c. \<lbrakk>valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; (isReplyCap cap' \<and> \<not> capReplyMaster cap') = is_reply_cap cap; (isReplyCap cap' \<and> capReplyMaster cap') = is_master_reply_cap cap; \<not> isReplyCap (cteCap rv); isReplyCap (cteCap rv) = isReplyCap cap'\<rbrakk> \<Longrightarrow> \<not> isReplyCap cap'
 2. \<And>rv a b ba t c baa aa. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> \<not> isEndpointCap cap'
 3. \<And>rv a b ba t c baa aa. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> \<not> isNotificationCap cap'
 4. \<And>rv a b ba t c. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> (\<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) t \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b)) \<and> cdt_list_relation (cdt_list a) (cdt a) ((ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>_. cap') rv))
 5. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 6. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 7. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 8. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 9. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (8 subgoals):
 1. \<And>rv a b ba t c baa aa. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> \<not> isEndpointCap cap'
 2. \<And>rv a b ba t c baa aa. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> \<not> isNotificationCap cap'
 3. \<And>rv a b ba t c. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> (\<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) t \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b)) \<and> cdt_list_relation (cdt_list a) (cdt a) ((ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>_. cap') rv))
 4. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 5. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 6. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 8. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (8 subgoals):
 1. \<And>rv a b ba t c baa aa. \<lbrakk>valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; isEndpointCap cap' = is_ep_cap cap; isEndpointCap (cteCap rv) = is_ep_cap c\<rbrakk> \<Longrightarrow> \<not> isEndpointCap cap'
 2. \<And>rv a b ba t c baa aa. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> \<not> isNotificationCap cap'
 3. \<And>rv a b ba t c. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> (\<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) t \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b)) \<and> cdt_list_relation (cdt_list a) (cdt a) ((ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>_. cap') rv))
 4. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 5. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 6. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 8. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (8 subgoals):
 1. \<And>rv a b ba t c baa aa. \<lbrakk>valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; isEndpointCap cap' = is_ep_cap cap; isEndpointCap (cteCap rv) = is_ep_cap c; is_ep_cap c = is_ep_cap cap\<rbrakk> \<Longrightarrow> \<not> isEndpointCap cap'
 2. \<And>rv a b ba t c baa aa. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> \<not> isNotificationCap cap'
 3. \<And>rv a b ba t c. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> (\<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) t \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b)) \<and> cdt_list_relation (cdt_list a) (cdt a) ((ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>_. cap') rv))
 4. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 5. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 6. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 8. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (7 subgoals):
 1. \<And>rv a b ba t c baa aa. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> \<not> isNotificationCap cap'
 2. \<And>rv a b ba t c. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> (\<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) t \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b)) \<and> cdt_list_relation (cdt_list a) (cdt a) ((ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>_. cap') rv))
 3. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 4. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 5. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (7 subgoals):
 1. \<And>rv a b ba t c baa aa. \<lbrakk>valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; isNotificationCap cap' = is_ntfn_cap cap; isNotificationCap (cteCap rv) = is_ntfn_cap c\<rbrakk> \<Longrightarrow> \<not> isNotificationCap cap'
 2. \<And>rv a b ba t c. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> (\<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) t \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b)) \<and> cdt_list_relation (cdt_list a) (cdt a) ((ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>_. cap') rv))
 3. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 4. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 5. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (7 subgoals):
 1. \<And>rv a b ba t c baa aa. \<lbrakk>valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; isNotificationCap cap' = is_ntfn_cap cap; isNotificationCap (cteCap rv) = is_ntfn_cap c; is_ntfn_cap c = is_ntfn_cap cap\<rbrakk> \<Longrightarrow> \<not> isNotificationCap cap'
 2. \<And>rv a b ba t c. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> (\<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) t \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b)) \<and> cdt_list_relation (cdt_list a) (cdt a) ((ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>_. cap') rv))
 3. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 4. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 5. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 7. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (6 subgoals):
 1. \<And>rv a b ba t c. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> (\<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) t \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b)) \<and> cdt_list_relation (cdt_list a) (cdt a) ((ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>_. cap') rv))
 2. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 3. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 4. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 5. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (6 subgoals):
 1. \<And>rv a b ba t c. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list a) (cdt a) ((ctes_of b)(cte_map slot \<mapsto> cteCap_update (\<lambda>_. cap') rv))
 2. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 3. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 4. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 5. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (6 subgoals):
 1. \<And>rv a b ba t c. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv)\<rbrakk> \<Longrightarrow> \<forall>aa ba cap node. (if cte_map (aa, ba) = cte_map slot then Some (cteCap_update (\<lambda>_. cap') rv) else ctes_of b (cte_map (aa, ba))) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next)
 2. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 3. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 4. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 5. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (6 subgoals):
 1. \<And>rv a b ba t c aa bb capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv); (if cte_map (aa, bb) = cte_map slot then Some (cteCap_update (\<lambda>_. cap') rv) else ctes_of b (cte_map (aa, bb))) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 3. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 4. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 5. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (6 subgoals):
 1. \<And>rv a b ba t c aa bb capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv); (if cte_map (aa, bb) = cte_map slot then Some (cteCap_update (\<lambda>_. cap') rv) else ctes_of b (cte_map (aa, bb))) = Some (CTE capa node); \<forall>ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); \<forall>ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next)\<rbrakk> \<Longrightarrow> case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 3. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 4. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 5. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (6 subgoals):
 1. \<And>rv a b ba t c aa bb capa node. \<lbrakk>cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv); (if cte_map (aa, bb) = cte_map slot then Some (cteCap_update (\<lambda>_. cap') rv) else ctes_of b (cte_map (aa, bb))) = Some (CTE capa node); cte_wp_at (\<lambda>_. True) (aa, bb) a \<longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) = descendants_of' (cte_map (aa, bb)) (ctes_of b); \<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next)\<rbrakk> \<Longrightarrow> case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 3. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 4. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 5. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (6 subgoals):
 1. \<And>rv a b ba t c aa bb capa node. \<lbrakk>cte_wp_at (\<lambda>_. True) (aa, bb) a \<longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) = descendants_of' (cte_map slot) (ctes_of b); \<forall>cap node. rv = CTE cap node \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); cap_relation cap cap'; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot a; pspace_aligned' b; pspace_distinct' b; cte_wp_at' (\<lambda>_. True) (cte_map slot) b; ctes_of b (cte_map slot) = Some rv; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap cap slot a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap); cdt t = cdt a; exst t = exst a; cte_wp_at ((=) c) slot a; cap_master_cap c = cap_master_cap cap; \<not> is_reply_cap c; \<not> is_master_reply_cap c; \<not> is_ep_cap c; \<not> is_ntfn_cap c; cap_relation c (cteCap rv); cte_map (aa, bb) = cte_map slot; cteCap_update (\<lambda>_. cap') rv = CTE capa node\<rbrakk> \<Longrightarrow> case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 3. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 4. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 5. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 6. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (5 subgoals):
 1. cap_relation cap cap' \<Longrightarrow> \<lbrace>?Q'4\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)\<rbrace>
 2. \<And>s. cap_relation cap cap' \<Longrightarrow> \<lbrace>\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s'\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>rv s'. (s, s') \<in> state_relation\<rbrace>
 3. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 4. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 5. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and ?Q'4) s proof (prove)
goal (4 subgoals):
 1. \<And>s sa. \<lbrakk>cap_relation cap cap'; (s, sa) \<in> state_relation \<and> ?P'4 sa\<rbrakk> \<Longrightarrow> \<forall>cte. cte_wp_at' ((=) cte) (cte_map slot) sa \<longrightarrow> (s, sa) \<in> state_relation
 2. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 3. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 4. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and (\<lambda>s. \<forall>cte. cte_wp_at' ((=) cte) (cte_map slot) s \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)) s)) s proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>cap_relation cap cap'; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. (s, s') \<in> state_relation \<and> ?P'4 s') (getCTE (cte_map slot))
 2. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 3. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and (\<lambda>s. \<forall>cte. cte_wp_at' ((=) cte) (cte_map slot) s \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)) s)) s proof (prove)
goal (3 subgoals):
 1. \<And>s sa. \<lbrakk>cap_relation cap cap'; True; (s, sa) \<in> state_relation \<and> ?P'4 sa\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) sa
 2. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 3. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and (\<lambda>s. \<forall>cte. cte_wp_at' ((=) cte) (cte_map slot) s \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)) s)) s proof (prove)
goal (3 subgoals):
 1. \<And>s sa. \<lbrakk>cap_relation cap cap'; (s, sa) \<in> state_relation; ?P'4 sa\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) sa
 2. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 3. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (?P'4 and (\<lambda>s. \<forall>cte. cte_wp_at' ((=) cte) (cte_map slot) s \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)) s)) s proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>cap_relation cap cap'; (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s\<rbrakk> \<Longrightarrow> (valid_objs and pspace_aligned and pspace_distinct and cte_wp_at (\<lambda>c. cap_master_cap c = cap_master_cap cap \<and> \<not> is_reply_cap c \<and> \<not> is_master_reply_cap c \<and> \<not> is_ep_cap c \<and> \<not> is_ntfn_cap c) slot) s
 2. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>cte. cte_wp_at' ((=) cte) (cte_map slot) s \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)) s)) s proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>cap_relation cap cap'; (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. \<forall>cte. cte_wp_at' ((=) cte) (cte_map slot) s \<longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. ctes_of s (cte_map slot) = Some cte)) s)) s proof (prove)
goal:
No subgoals!