theory CSpace1_R

lemma setCTE_UntypedCap_corres:
  "\<lbrakk>cap_relation cap (cteCap cte); is_untyped_cap cap; idx' = idx\<rbrakk>
   \<Longrightarrow> corres dc (cte_wp_at ((=) cap) src and valid_objs and
                  pspace_aligned and pspace_distinct)
                 (cte_wp_at' ((=) cte) (cte_map src) and
                  pspace_distinct' and pspace_aligned')
                 (set_cap (free_index_update (\<lambda>_. idx) cap) src)
                 (setCTE (cte_map src) (cteCap_update
                    (\<lambda>cap. (capFreeIndex_update (\<lambda>_. idx') (cteCap cte))) cte))" apply (case_tac cte) apply (clarsimp simp:is_cap_simps) apply (rule corres_stronger_no_failI) apply (rule no_fail_pre, wp) apply (clarsimp simp: cte_wp_at_ctes_of) apply clarsimp apply (clarsimp simp add: state_relation_def split_def) apply (drule (1) pspace_relationsD) apply (frule_tac c = "cap.UntypedCap dev r bits idx"
                in set_cap_not_quite_corres_prequel) apply assumption+ apply (erule cte_wp_at_weakenE, rule TrueI) apply assumption+ apply simp+ apply clarsimp apply (rule bexI) prefer 2 apply assumption apply (clarsimp simp: pspace_relations_def) apply (subst conj_assoc[symmetric]) apply (rule conjI) apply (frule setCTE_pspace_only) apply (clarsimp simp: set_cap_def in_monad split_def get_object_def set_object_def
                    split: if_split_asm Structures_A.kernel_object.splits) apply (rule conjI) apply (frule setCTE_pspace_only) apply (clarsimp simp: ghost_relation_typ_at set_cap_a_type_inv data_at_def) apply (rule conjI) prefer 2 apply (rule conjI) apply (frule mdb_set_cap, frule exst_set_cap) apply (erule use_valid [OF _ setCTE_ctes_of_wp]) apply (clarsimp simp: cdt_list_relation_def cte_wp_at_ctes_of split: if_split_asm) apply (rule conjI) prefer 2 apply (frule setCTE_pspace_only) apply clarsimp apply (clarsimp simp: set_cap_def in_monad split_def get_object_def set_object_def
                    split: if_split_asm Structures_A.kernel_object.splits) apply (frule set_cap_caps_of_state_monad) apply (drule is_original_cap_set_cap) apply clarsimp apply (erule use_valid [OF _ setCTE_ctes_of_wp]) apply (clarsimp simp: revokable_relation_def simp del: fun_upd_apply) apply (clarsimp split: if_split_asm) apply (frule cte_map_inj_eq) prefer 2 apply (erule cte_wp_at_weakenE, rule TrueI) apply (simp add: null_filter_def split: if_split_asm) apply (erule cte_wp_at_weakenE, rule TrueI) apply (erule caps_of_state_cte_at) apply fastforce apply fastforce apply fastforce apply clarsimp apply (simp add: null_filter_def split: if_split_asm) apply (erule_tac x=aa in allE, erule_tac x=bb in allE) apply (case_tac cte) apply (clarsimp simp: cte_wp_at_caps_of_state is_cap_simps isCap_simps cte_wp_at_ctes_of) apply (simp add: null_filter_def cte_wp_at_caps_of_state split: if_split_asm) apply (erule_tac x=aa in allE, erule_tac x=bb in allE) apply (clarsimp) apply (clarsimp simp: cdt_relation_def) apply (frule set_cap_caps_of_state_monad) apply (frule mdb_set_cap) apply clarsimp apply (erule use_valid [OF _ setCTE_ctes_of_wp]) apply (frule cte_wp_at_norm) apply (clarsimp simp:cte_wp_at_ctes_of simp del: fun_upd_apply) apply (drule_tac slot = "cte_map (aa,bb)" in updateUntypedCap_descendants_of) apply (clarsimp simp:isCap_simps) apply (drule_tac x = aa in spec) apply (drule_tac x = bb in spec) apply (erule impE) apply (clarsimp simp: cte_wp_at_caps_of_state split:if_splits) apply auto done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation cap (cteCap cte); is_untyped_cap cap; idx' = idx\<rbrakk> \<Longrightarrow> corres dc (cte_wp_at ((=) cap) src and valid_objs and pspace_aligned and pspace_distinct) (cte_wp_at' ((=) cte) (cte_map src) and pspace_distinct' and pspace_aligned') (set_cap (free_index_update (\<lambda>_. idx) cap) src) (setCTE (cte_map src) (cteCap_update (\<lambda>cap. capFreeIndex_update (\<lambda>_. idx') (cteCap cte)) cte)) proof (prove)
goal (1 subgoal):
 1. \<And>x1 x2. \<lbrakk>cap_relation cap (cteCap cte); is_untyped_cap cap; idx' = idx; cte = CTE x1 x2\<rbrakk> \<Longrightarrow> corres dc (cte_wp_at ((=) cap) src and valid_objs and pspace_aligned and pspace_distinct) (cte_wp_at' ((=) cte) (cte_map src) and pspace_distinct' and pspace_aligned') (set_cap (free_index_update (\<lambda>_. idx) cap) src) (setCTE (cte_map src) (cteCap_update (\<lambda>cap. capFreeIndex_update (\<lambda>_. idx') (cteCap cte)) cte)) proof (prove)
goal (1 subgoal):
 1. \<And>x2 dev r bits f. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> corres dc (cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src and valid_objs and pspace_aligned and pspace_distinct) (cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) and pspace_distinct' and pspace_aligned') (set_cap (cap.UntypedCap dev r bits idx) src) (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2)) proof (prove)
goal (2 subgoals):
 1. \<And>x2 dev r bits f. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; True\<rbrakk> \<Longrightarrow> no_fail (\<lambda>s'. \<exists>s. (cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src and valid_objs and pspace_aligned and pspace_distinct) s \<and> (s, s') \<in> state_relation \<and> (cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) and pspace_distinct' and pspace_aligned') s') (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2))
 2. \<And>x2 dev r bits f. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src and valid_objs and pspace_aligned and pspace_distinct) s \<and> (cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) and pspace_distinct' and pspace_aligned') s' \<longrightarrow> (\<forall>(r', t')\<in>fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) s'). \<exists>(r, t)\<in>fst (set_cap (cap.UntypedCap dev r bits idx) src s). (t, t') \<in> state_relation \<and> dc r r') proof (prove)
goal (2 subgoals):
 1. \<And>x2 dev r bits f s. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; True; \<exists>sa. (cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src and valid_objs and pspace_aligned and pspace_distinct) sa \<and> (sa, s) \<in> state_relation \<and> (cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) and pspace_distinct' and pspace_aligned') s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map src) s
 2. \<And>x2 dev r bits f. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src and valid_objs and pspace_aligned and pspace_distinct) s \<and> (cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) and pspace_distinct' and pspace_aligned') s' \<longrightarrow> (\<forall>(r', t')\<in>fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) s'). \<exists>(r, t)\<in>fst (set_cap (cap.UntypedCap dev r bits idx) src s). (t, t') \<in> state_relation \<and> dc r r') proof (prove)
goal (1 subgoal):
 1. \<And>x2 dev r bits f. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src and valid_objs and pspace_aligned and pspace_distinct) s \<and> (cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) and pspace_distinct' and pspace_aligned') s' \<longrightarrow> (\<forall>(r', t')\<in>fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) s'). \<exists>(r, t)\<in>fst (set_cap (cap.UntypedCap dev r bits idx) src s). (t, t') \<in> state_relation \<and> dc r r') proof (prove)
goal (1 subgoal):
 1. \<And>x2 dev r bits f a b ba. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; (a, b) \<in> state_relation; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap (cap.UntypedCap dev r bits idx) src a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation proof (prove)
goal (1 subgoal):
 1. \<And>x2 dev r bits f a b ba. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap (cap.UntypedCap dev r bits idx) src a). pspace_relation (kheap (snd x)) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd x)) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd x)) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd x)) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd x)) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd x)) (cdt (snd x)) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd x)) (cdt (snd x)) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd x)) (null_filter (caps_of_state (snd x))) (ctes_of ba) \<and> (arch_state (snd x), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd x)) (interrupt_states (snd x)) (ksInterruptState ba) \<and> cur_thread (snd x) = ksCurThread ba \<and> idle_thread (snd x) = ksIdleThread ba \<and> machine_state (snd x) = ksMachineState ba \<and> work_units_completed (snd x) = ksWorkUnitsCompleted ba \<and> domain_index (snd x) = ksDomScheduleIdx ba \<and> domain_list (snd x) = ksDomSchedule ba \<and> cur_domain (snd x) = ksCurDomain ba \<and> domain_time (snd x) = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>x2 dev r bits f a b ba. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap (cap.UntypedCap dev r bits idx) src a). pspace_relation (kheap (snd x)) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd x)) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd x)) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd x)) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd x)) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd x)) (cdt (snd x)) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd x)) (cdt (snd x)) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd x)) (null_filter (caps_of_state (snd x))) (ctes_of ba) \<and> (arch_state (snd x), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd x)) (interrupt_states (snd x)) (ksInterruptState ba) \<and> cur_thread (snd x) = ksCurThread ba \<and> idle_thread (snd x) = ksIdleThread ba \<and> machine_state (snd x) = ksMachineState ba \<and> work_units_completed (snd x) = ksWorkUnitsCompleted ba \<and> domain_index (snd x) = ksDomScheduleIdx ba \<and> domain_list (snd x) = ksDomSchedule ba \<and> cur_domain (snd x) = ksCurDomain ba \<and> domain_time (snd x) = ksDomainTime ba proof (prove)
goal (10 subgoals):
 1. \<And>x2 dev r bits f a b ba. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b)\<rbrakk> \<Longrightarrow> (?x56 x2 dev r bits f a b ba, ?t'56 x2 dev r bits f a b ba) \<in> fst (setCTE (?p'56 x2 dev r bits f a b ba) (?c'56 x2 dev r bits f a b ba) b)
 2. \<And>x2 dev r bits f a b ba. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b)\<rbrakk> \<Longrightarrow> valid_objs a
 3. \<And>x2 dev r bits f a b ba. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b)\<rbrakk> \<Longrightarrow> pspace_aligned a
 4. \<And>x2 dev r bits f a b ba. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b)\<rbrakk> \<Longrightarrow> pspace_distinct a
 5. \<And>x2 dev r bits f a b ba. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (?p56 x2 dev r bits f a b ba) a
 6. \<And>x2 dev r bits f a b ba. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b)\<rbrakk> \<Longrightarrow> pspace_aligned' b
 7. \<And>x2 dev r bits f a b ba. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b)\<rbrakk> \<Longrightarrow> pspace_distinct' b
 8. \<And>x2 dev r bits f a b ba. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b)\<rbrakk> \<Longrightarrow> cap_relation (cap.UntypedCap dev r bits idx) (cteCap (?c'56 x2 dev r bits f a b ba))
 9. \<And>x2 dev r bits f a b ba. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b)\<rbrakk> \<Longrightarrow> ?p'56 x2 dev r bits f a b ba = cte_map (?p56 x2 dev r bits f a b ba)
 10. \<And>x2 dev r bits f a b ba. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b); \<exists>t. ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) (?p56 x2 dev r bits f a b ba) a) \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace (?t'56 x2 dev r bits f a b ba))\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap (cap.UntypedCap dev r bits idx) src a). pspace_relation (kheap (snd x)) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd x)) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd x)) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd x)) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd x)) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd x)) (cdt (snd x)) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd x)) (cdt (snd x)) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd x)) (null_filter (caps_of_state (snd x))) (ctes_of ba) \<and> (arch_state (snd x), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd x)) (interrupt_states (snd x)) (ksInterruptState ba) \<and> cur_thread (snd x) = ksCurThread ba \<and> idle_thread (snd x) = ksIdleThread ba \<and> machine_state (snd x) = ksMachineState ba \<and> work_units_completed (snd x) = ksWorkUnitsCompleted ba \<and> domain_index (snd x) = ksDomScheduleIdx ba \<and> domain_list (snd x) = ksDomSchedule ba \<and> cur_domain (snd x) = ksCurDomain ba \<and> domain_time (snd x) = ksDomainTime ba proof (prove)
goal (6 subgoals):
 1. \<And>x2 dev r bits f a b ba. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (?p56 x2 dev r bits f a b ba) a
 2. \<And>x2 dev r bits f a b ba. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b)\<rbrakk> \<Longrightarrow> pspace_aligned' b
 3. \<And>x2 dev r bits f a b ba. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b)\<rbrakk> \<Longrightarrow> pspace_distinct' b
 4. \<And>x2 dev r bits f a b ba. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b)\<rbrakk> \<Longrightarrow> cap_relation (cap.UntypedCap dev r bits idx) (cteCap (CTE (capability.UntypedCap dev r bits idx) x2))
 5. \<And>x2 dev r bits f a b ba. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b)\<rbrakk> \<Longrightarrow> cte_map src = cte_map (?p56 x2 dev r bits f a b ba)
 6. \<And>x2 dev r bits f a b ba. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b); \<exists>t. ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) (?p56 x2 dev r bits f a b ba) a) \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap (cap.UntypedCap dev r bits idx) src a). pspace_relation (kheap (snd x)) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd x)) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd x)) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd x)) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd x)) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd x)) (cdt (snd x)) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd x)) (cdt (snd x)) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd x)) (null_filter (caps_of_state (snd x))) (ctes_of ba) \<and> (arch_state (snd x), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd x)) (interrupt_states (snd x)) (ksInterruptState ba) \<and> cur_thread (snd x) = ksCurThread ba \<and> idle_thread (snd x) = ksIdleThread ba \<and> machine_state (snd x) = ksMachineState ba \<and> work_units_completed (snd x) = ksWorkUnitsCompleted ba \<and> domain_index (snd x) = ksDomScheduleIdx ba \<and> domain_list (snd x) = ksDomSchedule ba \<and> cur_domain (snd x) = ksCurDomain ba \<and> domain_time (snd x) = ksDomainTime ba proof (prove)
goal (5 subgoals):
 1. \<And>x2 dev r bits f a b ba. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b)\<rbrakk> \<Longrightarrow> pspace_aligned' b
 2. \<And>x2 dev r bits f a b ba. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b)\<rbrakk> \<Longrightarrow> pspace_distinct' b
 3. \<And>x2 dev r bits f a b ba. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b)\<rbrakk> \<Longrightarrow> cap_relation (cap.UntypedCap dev r bits idx) (cteCap (CTE (capability.UntypedCap dev r bits idx) x2))
 4. \<And>x2 dev r bits f a b ba. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b)\<rbrakk> \<Longrightarrow> cte_map src = cte_map src
 5. \<And>x2 dev r bits f a b ba. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b); \<exists>t. ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a) \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap (cap.UntypedCap dev r bits idx) src a). pspace_relation (kheap (snd x)) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd x)) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd x)) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd x)) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd x)) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd x)) (cdt (snd x)) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd x)) (cdt (snd x)) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd x)) (null_filter (caps_of_state (snd x))) (ctes_of ba) \<and> (arch_state (snd x), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd x)) (interrupt_states (snd x)) (ksInterruptState ba) \<and> cur_thread (snd x) = ksCurThread ba \<and> idle_thread (snd x) = ksIdleThread ba \<and> machine_state (snd x) = ksMachineState ba \<and> work_units_completed (snd x) = ksWorkUnitsCompleted ba \<and> domain_index (snd x) = ksDomScheduleIdx ba \<and> domain_list (snd x) = ksDomSchedule ba \<and> cur_domain (snd x) = ksCurDomain ba \<and> domain_time (snd x) = ksDomainTime ba proof (prove)
goal (3 subgoals):
 1. \<And>x2 dev r bits f a b ba. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b)\<rbrakk> \<Longrightarrow> cap_relation (cap.UntypedCap dev r bits idx) (cteCap (CTE (capability.UntypedCap dev r bits idx) x2))
 2. \<And>x2 dev r bits f a b ba. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b)\<rbrakk> \<Longrightarrow> cte_map src = cte_map src
 3. \<And>x2 dev r bits f a b ba. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b); \<exists>t. ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a) \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap (cap.UntypedCap dev r bits idx) src a). pspace_relation (kheap (snd x)) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd x)) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd x)) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd x)) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd x)) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd x)) (cdt (snd x)) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd x)) (cdt (snd x)) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd x)) (null_filter (caps_of_state (snd x))) (ctes_of ba) \<and> (arch_state (snd x), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd x)) (interrupt_states (snd x)) (ksInterruptState ba) \<and> cur_thread (snd x) = ksCurThread ba \<and> idle_thread (snd x) = ksIdleThread ba \<and> machine_state (snd x) = ksMachineState ba \<and> work_units_completed (snd x) = ksWorkUnitsCompleted ba \<and> domain_index (snd x) = ksDomScheduleIdx ba \<and> domain_list (snd x) = ksDomSchedule ba \<and> cur_domain (snd x) = ksCurDomain ba \<and> domain_time (snd x) = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>x2 dev r bits f a b ba. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b); \<exists>t. ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a) \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap (cap.UntypedCap dev r bits idx) src a). pspace_relation (kheap (snd x)) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd x)) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd x)) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd x)) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd x)) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd x)) (cdt (snd x)) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd x)) (cdt (snd x)) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd x)) (null_filter (caps_of_state (snd x))) (ctes_of ba) \<and> (arch_state (snd x), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd x)) (interrupt_states (snd x)) (ksInterruptState ba) \<and> cur_thread (snd x) = ksCurThread ba \<and> idle_thread (snd x) = ksIdleThread ba \<and> machine_state (snd x) = ksMachineState ba \<and> work_units_completed (snd x) = ksWorkUnitsCompleted ba \<and> domain_index (snd x) = ksDomScheduleIdx ba \<and> domain_list (snd x) = ksDomSchedule ba \<and> cur_domain (snd x) = ksCurDomain ba \<and> domain_time (snd x) = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relations (ekheap t) (kheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap (cap.UntypedCap dev r bits idx) src a). pspace_relation (kheap (snd x)) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd x)) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd x)) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd x)) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd x)) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd x)) (cdt (snd x)) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd x)) (cdt (snd x)) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd x)) (null_filter (caps_of_state (snd x))) (ctes_of ba) \<and> (arch_state (snd x), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd x)) (interrupt_states (snd x)) (ksInterruptState ba) \<and> cur_thread (snd x) = ksCurThread ba \<and> idle_thread (snd x) = ksIdleThread ba \<and> machine_state (snd x) = ksMachineState ba \<and> work_units_completed (snd x) = ksWorkUnitsCompleted ba \<and> domain_index (snd x) = ksDomScheduleIdx ba \<and> domain_list (snd x) = ksDomSchedule ba \<and> cur_domain (snd x) = ksCurDomain ba \<and> domain_time (snd x) = ksDomainTime ba proof (prove)
goal (2 subgoals):
 1. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relations (ekheap t) (kheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> pspace_relation (kheap (snd (?x62 x2 dev r bits f a b ba t))) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd (?x62 x2 dev r bits f a b ba t))) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd (?x62 x2 dev r bits f a b ba t))) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd (?x62 x2 dev r bits f a b ba t))) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd (?x62 x2 dev r bits f a b ba t))) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd (?x62 x2 dev r bits f a b ba t))) (cdt (snd (?x62 x2 dev r bits f a b ba t))) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd (?x62 x2 dev r bits f a b ba t))) (cdt (snd (?x62 x2 dev r bits f a b ba t))) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd (?x62 x2 dev r bits f a b ba t))) (null_filter (caps_of_state (snd (?x62 x2 dev r bits f a b ba t)))) (ctes_of ba) \<and> (arch_state (snd (?x62 x2 dev r bits f a b ba t)), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd (?x62 x2 dev r bits f a b ba t))) (interrupt_states (snd (?x62 x2 dev r bits f a b ba t))) (ksInterruptState ba) \<and> cur_thread (snd (?x62 x2 dev r bits f a b ba t)) = ksCurThread ba \<and> idle_thread (snd (?x62 x2 dev r bits f a b ba t)) = ksIdleThread ba \<and> machine_state (snd (?x62 x2 dev r bits f a b ba t)) = ksMachineState ba \<and> work_units_completed (snd (?x62 x2 dev r bits f a b ba t)) = ksWorkUnitsCompleted ba \<and> domain_index (snd (?x62 x2 dev r bits f a b ba t)) = ksDomScheduleIdx ba \<and> domain_list (snd (?x62 x2 dev r bits f a b ba t)) = ksDomSchedule ba \<and> cur_domain (snd (?x62 x2 dev r bits f a b ba t)) = ksCurDomain ba \<and> domain_time (snd (?x62 x2 dev r bits f a b ba t)) = ksDomainTime ba
 2. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relations (ekheap t) (kheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> ?x62 x2 dev r bits f a b ba t \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a) proof (prove)
goal (2 subgoals):
 1. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relations (ekheap t) (kheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> ?x62 x2 dev r bits f a b ba t \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a)
 2. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relations (ekheap t) (kheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> pspace_relation (kheap (snd (?x62 x2 dev r bits f a b ba t))) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd (?x62 x2 dev r bits f a b ba t))) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd (?x62 x2 dev r bits f a b ba t))) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd (?x62 x2 dev r bits f a b ba t))) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd (?x62 x2 dev r bits f a b ba t))) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd (?x62 x2 dev r bits f a b ba t))) (cdt (snd (?x62 x2 dev r bits f a b ba t))) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd (?x62 x2 dev r bits f a b ba t))) (cdt (snd (?x62 x2 dev r bits f a b ba t))) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd (?x62 x2 dev r bits f a b ba t))) (null_filter (caps_of_state (snd (?x62 x2 dev r bits f a b ba t)))) (ctes_of ba) \<and> (arch_state (snd (?x62 x2 dev r bits f a b ba t)), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd (?x62 x2 dev r bits f a b ba t))) (interrupt_states (snd (?x62 x2 dev r bits f a b ba t))) (ksInterruptState ba) \<and> cur_thread (snd (?x62 x2 dev r bits f a b ba t)) = ksCurThread ba \<and> idle_thread (snd (?x62 x2 dev r bits f a b ba t)) = ksIdleThread ba \<and> machine_state (snd (?x62 x2 dev r bits f a b ba t)) = ksMachineState ba \<and> work_units_completed (snd (?x62 x2 dev r bits f a b ba t)) = ksWorkUnitsCompleted ba \<and> domain_index (snd (?x62 x2 dev r bits f a b ba t)) = ksDomScheduleIdx ba \<and> domain_list (snd (?x62 x2 dev r bits f a b ba t)) = ksDomSchedule ba \<and> cur_domain (snd (?x62 x2 dev r bits f a b ba t)) = ksCurDomain ba \<and> domain_time (snd (?x62 x2 dev r bits f a b ba t)) = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relations (ekheap a) (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relations (ekheap t) (kheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> pspace_relation (kheap (snd ((), t))) (ksPSpace ba) \<and> ekheap_relation (ekheap (snd ((), t))) (ksPSpace ba) \<and> sched_act_relation (scheduler_action (snd ((), t))) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues (snd ((), t))) (ksReadyQueues ba) \<and> ghost_relation (kheap (snd ((), t))) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) (snd ((), t))) (cdt (snd ((), t))) (ctes_of ba) \<and> cdt_list_relation (cdt_list (snd ((), t))) (cdt (snd ((), t))) (ctes_of ba) \<and> revokable_relation (is_original_cap (snd ((), t))) (null_filter (caps_of_state (snd ((), t)))) (ctes_of ba) \<and> (arch_state (snd ((), t)), ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node (snd ((), t))) (interrupt_states (snd ((), t))) (ksInterruptState ba) \<and> cur_thread (snd ((), t)) = ksCurThread ba \<and> idle_thread (snd ((), t)) = ksIdleThread ba \<and> machine_state (snd ((), t)) = ksMachineState ba \<and> work_units_completed (snd ((), t)) = ksWorkUnitsCompleted ba \<and> domain_index (snd ((), t)) = ksDomScheduleIdx ba \<and> domain_list (snd ((), t)) = ksDomSchedule ba \<and> cur_domain (snd ((), t)) = ksCurDomain ba \<and> domain_time (snd ((), t)) = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> (sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba)) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (2 subgoals):
 1. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba)
 2. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (2 subgoals):
 1. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); \<exists>ps'. ba = b\<lparr>ksPSpace := ps'\<rparr>\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba)
 2. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (2 subgoals):
 1. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba)
 2. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (2 subgoals):
 1. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); \<exists>ps'. ba = b\<lparr>ksPSpace := ps'\<rparr>\<rbrakk> \<Longrightarrow> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba)
 2. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (2 subgoals):
 1. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba)
 2. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (2 subgoals):
 1. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 2. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) proof (prove)
goal (3 subgoals):
 1. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba)
 2. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 3. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) proof (prove)
goal (3 subgoals):
 1. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); cdt t = cdt a; exst t = exst a\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba)
 2. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 3. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) proof (prove)
goal (3 subgoals):
 1. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); cdt t = cdt a; exst t = exst a\<rbrakk> \<Longrightarrow> cdt_list_relation (cdt_list t) (cdt t) ((ctes_of b)(cte_map src \<mapsto> CTE (capability.UntypedCap dev r bits idx) x2))
 2. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 3. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) proof (prove)
goal (2 subgoals):
 1. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 2. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) proof (prove)
goal (3 subgoals):
 1. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba)
 2. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 3. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) proof (prove)
goal (3 subgoals):
 1. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 2. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba)
 3. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) proof (prove)
goal (3 subgoals):
 1. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); \<exists>ps'. ba = b\<lparr>ksPSpace := ps'\<rparr>\<rbrakk> \<Longrightarrow> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 2. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba)
 3. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) proof (prove)
goal (3 subgoals):
 1. \<And>x2 dev r bits f a b t ps'. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), b\<lparr>ksPSpace := ps'\<rparr>) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) ps'; ekheap_relation (ekheap t) ps'\<rbrakk> \<Longrightarrow> (arch_state t, ksArchState b) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState b) \<and> cur_thread t = ksCurThread b \<and> idle_thread t = ksIdleThread b \<and> machine_state t = ksMachineState b \<and> work_units_completed t = ksWorkUnitsCompleted b \<and> domain_index t = ksDomScheduleIdx b \<and> domain_list t = ksDomSchedule b \<and> cur_domain t = ksCurDomain b \<and> domain_time t = ksDomainTime b
 2. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba)
 3. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) proof (prove)
goal (2 subgoals):
 1. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba)
 2. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) proof (prove)
goal (2 subgoals):
 1. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba)
 2. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) proof (prove)
goal (2 subgoals):
 1. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba)
 2. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) proof (prove)
goal (2 subgoals):
 1. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap a) (null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx))) (ctes_of ba)
 2. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) proof (prove)
goal (2 subgoals):
 1. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a\<rbrakk> \<Longrightarrow> revokable_relation (is_original_cap a) (null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx))) ((ctes_of b)(cte_map src \<mapsto> CTE (capability.UntypedCap dev r bits idx) x2))
 2. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) proof (prove)
goal (2 subgoals):
 1. \<And>x2 dev r bits f a b ba t aa bb y capa node. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; ((ctes_of b)(cte_map src \<mapsto> CTE (capability.UntypedCap dev r bits idx) x2)) (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 2. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) proof (prove)
goal (3 subgoals):
 1. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map src\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable x2
 2. \<And>x2 dev r bits f a b ba t aa bb y capa node. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) \<noteq> cte_map src; ctes_of b (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 3. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) proof (prove)
goal (8 subgoals):
 1. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map src\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (aa, bb) (?s353 x2 dev r bits f a b ba t aa bb y)
 2. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map src\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) src (?s353 x2 dev r bits f a b ba t aa bb y)
 3. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map src\<rbrakk> \<Longrightarrow> valid_objs (?s353 x2 dev r bits f a b ba t aa bb y)
 4. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map src\<rbrakk> \<Longrightarrow> pspace_aligned (?s353 x2 dev r bits f a b ba t aa bb y)
 5. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map src\<rbrakk> \<Longrightarrow> pspace_distinct (?s353 x2 dev r bits f a b ba t aa bb y)
 6. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map src; (aa, bb) = src\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable x2
 7. \<And>x2 dev r bits f a b ba t aa bb y capa node. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) \<noteq> cte_map src; ctes_of b (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 8. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) proof (prove)
goal (8 subgoals):
 1. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map src\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) src (?s353 x2 dev r bits f a b ba t aa bb y)
 2. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map src\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (aa, bb) (?s353 x2 dev r bits f a b ba t aa bb y)
 3. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map src\<rbrakk> \<Longrightarrow> valid_objs (?s353 x2 dev r bits f a b ba t aa bb y)
 4. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map src\<rbrakk> \<Longrightarrow> pspace_aligned (?s353 x2 dev r bits f a b ba t aa bb y)
 5. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map src\<rbrakk> \<Longrightarrow> pspace_distinct (?s353 x2 dev r bits f a b ba t aa bb y)
 6. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map src; (aa, bb) = src\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable x2
 7. \<And>x2 dev r bits f a b ba t aa bb y capa node. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) \<noteq> cte_map src; ctes_of b (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 8. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) proof (prove)
goal (7 subgoals):
 1. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map src\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (aa, bb) a
 2. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map src\<rbrakk> \<Longrightarrow> valid_objs a
 3. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map src\<rbrakk> \<Longrightarrow> pspace_aligned a
 4. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map src\<rbrakk> \<Longrightarrow> pspace_distinct a
 5. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map src; (aa, bb) = src\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable x2
 6. \<And>x2 dev r bits f a b ba t aa bb y capa node. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) \<noteq> cte_map src; ctes_of b (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 7. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) proof (prove)
goal (8 subgoals):
 1. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. caps_of_state a (aa, ba) = Some cap.NullCap \<or> caps_of_state a (aa, ba) = None \<or> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> y); is_original_cap t = is_original_cap a; y \<noteq> cap.NullCap; (aa, bb) = src; cap.UntypedCap dev r bits idx = y\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) src a
 2. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>cte_map (aa, bb) = cte_map src; idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. caps_of_state a (aa, ba) = Some cap.NullCap \<or> caps_of_state a (aa, ba) = None \<or> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; y \<noteq> cap.NullCap; (aa, bb) \<noteq> src; caps_of_state a (aa, bb) = Some y\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (aa, bb) a
 3. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map src\<rbrakk> \<Longrightarrow> valid_objs a
 4. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map src\<rbrakk> \<Longrightarrow> pspace_aligned a
 5. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map src\<rbrakk> \<Longrightarrow> pspace_distinct a
 6. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map src; (aa, bb) = src\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable x2
 7. \<And>x2 dev r bits f a b ba t aa bb y capa node. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) \<noteq> cte_map src; ctes_of b (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 8. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) proof (prove)
goal (7 subgoals):
 1. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>cte_map (aa, bb) = cte_map src; idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. caps_of_state a (aa, ba) = Some cap.NullCap \<or> caps_of_state a (aa, ba) = None \<or> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; y \<noteq> cap.NullCap; (aa, bb) \<noteq> src; caps_of_state a (aa, bb) = Some y\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (aa, bb) a
 2. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map src\<rbrakk> \<Longrightarrow> valid_objs a
 3. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map src\<rbrakk> \<Longrightarrow> pspace_aligned a
 4. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map src\<rbrakk> \<Longrightarrow> pspace_distinct a
 5. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map src; (aa, bb) = src\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable x2
 6. \<And>x2 dev r bits f a b ba t aa bb y capa node. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) \<noteq> cte_map src; ctes_of b (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 7. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) proof (prove)
goal (6 subgoals):
 1. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map src\<rbrakk> \<Longrightarrow> valid_objs a
 2. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map src\<rbrakk> \<Longrightarrow> pspace_aligned a
 3. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map src\<rbrakk> \<Longrightarrow> pspace_distinct a
 4. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map src; (aa, bb) = src\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable x2
 5. \<And>x2 dev r bits f a b ba t aa bb y capa node. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) \<noteq> cte_map src; ctes_of b (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 6. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) proof (prove)
goal (5 subgoals):
 1. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map src\<rbrakk> \<Longrightarrow> pspace_aligned a
 2. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map src\<rbrakk> \<Longrightarrow> pspace_distinct a
 3. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map src; (aa, bb) = src\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable x2
 4. \<And>x2 dev r bits f a b ba t aa bb y capa node. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) \<noteq> cte_map src; ctes_of b (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 5. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) proof (prove)
goal (4 subgoals):
 1. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map src\<rbrakk> \<Longrightarrow> pspace_distinct a
 2. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map src; (aa, bb) = src\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable x2
 3. \<And>x2 dev r bits f a b ba t aa bb y capa node. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) \<noteq> cte_map src; ctes_of b (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 4. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) proof (prove)
goal (3 subgoals):
 1. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) = cte_map src; (aa, bb) = src\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable x2
 2. \<And>x2 dev r bits f a b ba t aa bb y capa node. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) \<noteq> cte_map src; ctes_of b (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 3. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) proof (prove)
goal (3 subgoals):
 1. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) (aa, bb) a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map (aa, bb)) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)((aa, bb) \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)((aa, bb) \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; src = (aa, bb)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable x2
 2. \<And>x2 dev r bits f a b ba t aa bb y capa node. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) \<noteq> cte_map src; ctes_of b (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 3. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) proof (prove)
goal (3 subgoals):
 1. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>\<forall>aa ba. caps_of_state a (aa, ba) = Some cap.NullCap \<or> caps_of_state a (aa, ba) = None \<or> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)((aa, bb) \<mapsto> y); is_original_cap t = is_original_cap a; cap.UntypedCap dev r bits idx = y; src = (aa, bb); idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) (aa, bb) a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map (aa, bb)) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable x2
 2. \<And>x2 dev r bits f a b ba t aa bb y capa node. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) \<noteq> cte_map src; ctes_of b (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 3. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) proof (prove)
goal (3 subgoals):
 1. \<And>x2 dev r bits f a b ba t aa bb y. \<lbrakk>(arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)((aa, bb) \<mapsto> y); is_original_cap t = is_original_cap a; cap.UntypedCap dev r bits idx = y; src = (aa, bb); idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) (aa, bb) a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map (aa, bb)) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); caps_of_state a (aa, bb) = Some cap.NullCap \<or> caps_of_state a (aa, bb) = None \<or> (\<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable x2
 2. \<And>x2 dev r bits f a b ba t aa bb y capa node. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) \<noteq> cte_map src; ctes_of b (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 3. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) proof (prove)
goal (3 subgoals):
 1. \<And>x2 dev r bits f a b ba t aa bb y x1 x2a. \<lbrakk>(arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)((aa, bb) \<mapsto> y); is_original_cap t = is_original_cap a; cap.UntypedCap dev r bits idx = y; src = (aa, bb); idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) (aa, bb) a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map (aa, bb)) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); caps_of_state a (aa, bb) = Some cap.NullCap \<or> caps_of_state a (aa, bb) = None \<or> (\<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node); cte = CTE x1 x2a\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable x2
 2. \<And>x2 dev r bits f a b ba t aa bb y capa node. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) \<noteq> cte_map src; ctes_of b (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 3. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) proof (prove)
goal (2 subgoals):
 1. \<And>x2 dev r bits f a b ba t aa bb y capa node. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; null_filter ((caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)) (aa, bb) = Some y; cte_map (aa, bb) \<noteq> cte_map src; ctes_of b (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 2. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) proof (prove)
goal (2 subgoals):
 1. \<And>x2 dev r bits f a b ba t aa bb y capa node. \<lbrakk>cte_map (aa, bb) \<noteq> cte_map src; ctes_of b (cte_map (aa, bb)) = Some (CTE capa node); idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; caps_of_state a src = Some (cap.UntypedCap dev r bits f); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. caps_of_state a (aa, ba) = Some cap.NullCap \<or> caps_of_state a (aa, ba) = None \<or> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; y \<noteq> cap.NullCap; (aa, bb) \<noteq> src; caps_of_state a (aa, bb) = Some y\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 2. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) proof (prove)
goal (2 subgoals):
 1. \<And>x2 dev r bits f a b ba t aa bb y capa node. \<lbrakk>cte_map (aa, bb) \<noteq> cte_map src; ctes_of b (cte_map (aa, bb)) = Some (CTE capa node); idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; caps_of_state a src = Some (cap.UntypedCap dev r bits f); valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); is_original_cap t = is_original_cap a; y \<noteq> cap.NullCap; (aa, bb) \<noteq> src; caps_of_state a (aa, bb) = Some y; caps_of_state a (aa, bb) = Some cap.NullCap \<or> caps_of_state a (aa, bb) = None \<or> (\<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 2. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) proof (prove)
goal (1 subgoal):
 1. \<And>x2 dev r bits f a b ba t. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) proof (prove)
goal (1 subgoal):
 1. \<And>x2 dev r bits f a b ba t aa bb. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) t\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (cdt t) = descendants_of' (cte_map (aa, bb)) (ctes_of ba) proof (prove)
goal (1 subgoal):
 1. \<And>x2 dev r bits f a b ba t aa bb. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) t; caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx)\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (cdt t) = descendants_of' (cte_map (aa, bb)) (ctes_of ba) proof (prove)
goal (1 subgoal):
 1. \<And>x2 dev r bits f a b ba t aa bb. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) t; caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); cdt t = cdt a\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (cdt t) = descendants_of' (cte_map (aa, bb)) (ctes_of ba) proof (prove)
goal (1 subgoal):
 1. \<And>x2 dev r bits f a b ba t aa bb. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; ((), ba) \<in> fst (setCTE (cte_map src) (CTE (capability.UntypedCap dev r bits idx) x2) b); cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) t; caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); cdt t = cdt a\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) = descendants_of' (cte_map (aa, bb)) (ctes_of ba) proof (prove)
goal (1 subgoal):
 1. \<And>x2 dev r bits f a b ba t aa bb. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) t; caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); cdt t = cdt a\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) = descendants_of' (cte_map (aa, bb)) ((ctes_of b)(cte_map src \<mapsto> CTE (capability.UntypedCap dev r bits idx) x2)) proof (prove)
goal (1 subgoal):
 1. \<And>x2 dev r bits f a b ba t aa bb. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; cte_wp_at' ((=) (CTE (capability.UntypedCap dev r bits f) x2)) (cte_map src) b; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) t; caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); cdt t = cdt a; \<exists>c. cte_wp_at ((=) c) src a \<and> cap.UntypedCap dev r bits f = c\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) = descendants_of' (cte_map (aa, bb)) ((ctes_of b)(cte_map src \<mapsto> CTE (capability.UntypedCap dev r bits idx) x2)) proof (prove)
goal (1 subgoal):
 1. \<And>x2 dev r bits f a b ba t aa bb. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; ctes_of b (cte_map src) = Some (CTE (capability.UntypedCap dev r bits f) x2); pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) t; caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); cdt t = cdt a\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) = descendants_of' (cte_map (aa, bb)) ((ctes_of b)(cte_map src \<mapsto> CTE (capability.UntypedCap dev r bits idx) x2)) proof (prove)
goal (2 subgoals):
 1. \<And>x2 dev r bits f a b ba t aa bb. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) t; caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); cdt t = cdt a\<rbrakk> \<Longrightarrow> isUntypedCap (cteCap (CTE (capability.UntypedCap dev r bits f) x2))
 2. \<And>x2 dev r bits f a b ba t aa bb. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) t; caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); cdt t = cdt a; descendants_of' (cte_map (aa, bb)) ((ctes_of b)(cte_map src \<mapsto> cteCap_update (\<lambda>_. capFreeIndex_update (\<lambda>_. ?idx476 x2 dev r bits f a b ba t aa bb) (cteCap (CTE (capability.UntypedCap dev r bits f) x2))) (CTE (capability.UntypedCap dev r bits f) x2))) = descendants_of' (cte_map (aa, bb)) (ctes_of b)\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) = descendants_of' (cte_map (aa, bb)) ((ctes_of b)(cte_map src \<mapsto> CTE (capability.UntypedCap dev r bits idx) x2)) proof (prove)
goal (1 subgoal):
 1. \<And>x2 dev r bits f a b ba t aa bb. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) t; caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); cdt t = cdt a; descendants_of' (cte_map (aa, bb)) ((ctes_of b)(cte_map src \<mapsto> cteCap_update (\<lambda>_. capFreeIndex_update (\<lambda>_. ?idx476 x2 dev r bits f a b ba t aa bb) (cteCap (CTE (capability.UntypedCap dev r bits f) x2))) (CTE (capability.UntypedCap dev r bits f) x2))) = descendants_of' (cte_map (aa, bb)) (ctes_of b)\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) = descendants_of' (cte_map (aa, bb)) ((ctes_of b)(cte_map src \<mapsto> CTE (capability.UntypedCap dev r bits idx) x2)) proof (prove)
goal (1 subgoal):
 1. \<And>x2 dev r bits f a b ba t aa bb. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) t; caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); cdt t = cdt a; descendants_of' (cte_map (aa, bb)) ((ctes_of b)(cte_map src \<mapsto> cteCap_update (\<lambda>_. capFreeIndex_update (\<lambda>_. ?idx476 x2 dev r bits f a b ba t aa bb) (cteCap (CTE (capability.UntypedCap dev r bits f) x2))) (CTE (capability.UntypedCap dev r bits f) x2))) = descendants_of' (cte_map (aa, bb)) (ctes_of b); \<forall>ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b)\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) = descendants_of' (cte_map (aa, bb)) ((ctes_of b)(cte_map src \<mapsto> CTE (capability.UntypedCap dev r bits idx) x2)) proof (prove)
goal (1 subgoal):
 1. \<And>x2 dev r bits f a b ba t aa bb. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) t; caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); cdt t = cdt a; descendants_of' (cte_map (aa, bb)) ((ctes_of b)(cte_map src \<mapsto> cteCap_update (\<lambda>_. capFreeIndex_update (\<lambda>_. ?idx476 x2 dev r bits f a b ba t aa bb) (cteCap (CTE (capability.UntypedCap dev r bits f) x2))) (CTE (capability.UntypedCap dev r bits f) x2))) = descendants_of' (cte_map (aa, bb)) (ctes_of b); cte_wp_at (\<lambda>_. True) (aa, bb) a \<longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) = descendants_of' (cte_map (aa, bb)) (ctes_of b)\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) = descendants_of' (cte_map (aa, bb)) ((ctes_of b)(cte_map src \<mapsto> CTE (capability.UntypedCap dev r bits idx) x2)) proof (prove)
goal (2 subgoals):
 1. \<And>x2 dev r bits f a b ba t aa bb. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) t; caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); cdt t = cdt a; descendants_of' (cte_map (aa, bb)) ((ctes_of b)(cte_map src \<mapsto> cteCap_update (\<lambda>_. capFreeIndex_update (\<lambda>_. ?idx476 x2 dev r bits f a b ba t aa bb) (cteCap (CTE (capability.UntypedCap dev r bits f) x2))) (CTE (capability.UntypedCap dev r bits f) x2))) = descendants_of' (cte_map (aa, bb)) (ctes_of b)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (aa, bb) a
 2. \<And>x2 dev r bits f a b ba t aa bb. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) t; caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); cdt t = cdt a; descendants_of' (cte_map (aa, bb)) ((ctes_of b)(cte_map src \<mapsto> cteCap_update (\<lambda>_. capFreeIndex_update (\<lambda>_. ?idx476 x2 dev r bits f a b ba t aa bb) (cteCap (CTE (capability.UntypedCap dev r bits f) x2))) (CTE (capability.UntypedCap dev r bits f) x2))) = descendants_of' (cte_map (aa, bb)) (ctes_of b); cte_map ` descendants_of (aa, bb) (cdt a) = descendants_of' (cte_map (aa, bb)) (ctes_of b)\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) = descendants_of' (cte_map (aa, bb)) ((ctes_of b)(cte_map src \<mapsto> CTE (capability.UntypedCap dev r bits idx) x2)) proof (prove)
goal (1 subgoal):
 1. \<And>x2 dev r bits f a b ba t aa bb. \<lbrakk>idx' = idx; cte = CTE (capability.UntypedCap dev r bits f) x2; cap = cap.UntypedCap dev r bits f; cte_wp_at ((=) (cap.UntypedCap dev r bits f)) src a; valid_objs a; pspace_aligned a; pspace_distinct a; pspace_distinct' b; pspace_aligned' b; ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pspace_relation (kheap a) (ksPSpace b); ((), t) \<in> fst (set_cap (cap.UntypedCap dev r bits idx) src a); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap t) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) t; caps_of_state t = (caps_of_state a)(src \<mapsto> cap.UntypedCap dev r bits idx); cdt t = cdt a; descendants_of' (cte_map (aa, bb)) ((ctes_of b)(cte_map src \<mapsto> cteCap_update (\<lambda>_. capFreeIndex_update (\<lambda>_. ?idx476 x2 dev r bits f a b ba t aa bb) (cteCap (CTE (capability.UntypedCap dev r bits f) x2))) (CTE (capability.UntypedCap dev r bits f) x2))) = descendants_of' (cte_map (aa, bb)) (ctes_of b); cte_map ` descendants_of (aa, bb) (cdt a) = descendants_of' (cte_map (aa, bb)) (ctes_of b)\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) = descendants_of' (cte_map (aa, bb)) ((ctes_of b)(cte_map src \<mapsto> CTE (capability.UntypedCap dev r bits idx) x2)) proof (prove)
goal:
No subgoals!